corpus.blog
41,554 blogs · 5,197,919 posts Claim your blog
Record · corpus.blog/posts/01a0d4b5-15c5-72fb-9ccc-532d8c9b24d9

JavaGhost’s Persistent Phishing Attacks From the Cloud

Unit 42 · published 28 February 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at unit42.paloaltonetworks.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
63
Words captured
3,837

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.paloaltonetworks.com/cortex/cloud
paloaltonetworks.com
https://www.paloaltonetworks.com/cortex/cortex-xsiam
paloaltonetworks.com
https://defacer.id/archive/team=javaghost/page=1
defacer.id
https://web.archive.org/web/20220615003428/http://cloud.endekab.go.id/
web.archive.org
https://web.archive.org/web/20181109124556/http://www.javaghost.me/
web.archive.org
https://securitylabs.datadoghq.com/articles/following-attackers-trail-in-aws-methodology-findings-in-the-wild/
securitylabs.datadoghq.com
https://docs.aws.amazon.com/ses/latest/dg/Welcome.html
docs.aws.amazon.com
https://docs.aws.amazon.com/workmail/latest/userguide/what_is.html
docs.aws.amazon.com
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html
docs.aws.amazon.com
https://www.crowdstrike.com/en-us/blog/how-adversaries-persist-with-aws-user-federation/
crowdstrike.com
https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html
docs.aws.amazon.com
https://aws.amazon.com/cli/
aws.amazon.com
https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
docs.aws.amazon.com
https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuota.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference/API_GetSendQuota.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetAccount.html
docs.aws.amazon.com
https://github.com/NetSPI/aws_consoler/tree/master
github.com
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html
docs.aws.amazon.com
https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html
docs.aws.amazon.com
https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getfederationtoken.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html
docs.aws.amazon.com
https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDenyAll.html
docs.aws.amazon.com
https://repost.aws/knowledge-center/cloudtrail-data-management-events
repost.aws
https://docs.aws.amazon.com/ses/latest/dg/vdm.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateEmailIdentity.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityDkimAttributes.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityMailFromAttributes.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountVdmAttributes.html
docs.aws.amazon.com
https://docs.aws.amazon.com/workmail/latest/adminguide/organizations_overview.html
docs.aws.amazon.com
https://docs.aws.amazon.com/directoryservice/latest/admin-guide/what_is.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateReceiptRule.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateReceiptRuleSet.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference/API_PutIdentityPolicy.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference/API_SetActiveReceiptRuleSet.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyDomainDkim.html
docs.aws.amazon.com
https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyDomainIdentity.html
docs.aws.amazon.com
https://docs.aws.amazon.com/directoryservice/latest/admin-guide/UsingWithDS_IAM_ResourcePermissions.html
docs.aws.amazon.com
https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateAlias.html
docs.aws.amazon.com
https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateUser.html
docs.aws.amazon.com
https://docs.aws.amazon.com/workmail/latest/APIReference/API_RegisterToWorkMail.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateGroup.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutGroupPolicy.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html
docs.aws.amazon.com
https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateLoginProfile.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html
docs.aws.amazon.com
https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html
docs.aws.amazon.com
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html
docs.aws.amazon.com
https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSecurityGroup.html
docs.aws.amazon.com
https://docs.aws.amazon.com/organizations/latest/APIReference/API_LeaveOrganization.html
docs.aws.amazon.com
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html
docs.aws.amazon.com
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
docs.aws.amazon.com
https://docs.aws.amazon.com/controltower/latest/userguide/opt-in-region-considerations.html
docs.aws.amazon.com
https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
docs.aws.amazon.com
https://github.com/PaloAltoNetworks/Unit42-Threat-Intelligence-Article-Information/blob/main/List-of-IP-addresses-for-JavaGhost-activity-between-2022-and-2024.txt
github.com
https://www.crowdstrike.com/en-us/blog/how-adversaries-persist-with-aws-user-federation/?srsltid=AfmBOooHp9sQ4E_H0XoedsfPZXocU7BiAZBjeC5Q_c1pADGl_RXIcxap
crowdstrike.com
Survive Access Key Deletion with sts:GetFederationToken
hackingthe.cloud
https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-unwanted-visitor/?utm_source=cloudseclist.com&utm_medium=referral&utm_campaign=CloudSecList-issue-268
securitylabs.datadoghq.com
Elsewhere on unit42.paloaltonetworks.com (3)