JavaGhost’s Persistent Phishing Attacks From the Cloud

### Executive Summary Unit 42 attributes a series of cloud-based phishing campaigns to the JavaGhost group, which leverages exposed long-term AWS credentials to create SES/WorkMail identities, generate temporary console access via STS (GetFederationToken/GetSigninToken), and establish persistence (admin IAM users/roles and signature security groups) while using evasion techniques to avoid CloudTrail detection; the report includes IoCs, detection queries, and mitigation recommendations.