- Threat actors seen abused AWS -forking configuration to access the instances
- They would use the instances to create new Ses and Workmail services
- E -Mails would bypass E -Mail -Secethon while keeping attackers hidden
Misconfigured Amazon Web Services (AWS) environments are abused to run phishing campaigns that can bypass E -mail filters and lands right into people’s inbox, experts have claimed.
CyberSecurity scientists from Palo Alto Networks’ Unit 42 recently discovered a group traced as TGR-TUNK-0011 who participated in this type of attack.
The group, as Unity 42 says, overlaps significantly with a separate group called Javaghost, has been active since 2019. However, the group was initially focused on preserving sites and turning to phishing only in 2022 when they began to seek financial gain.
Javaghost
The attacks start with the group getting people’s AWS access keys. This gives them access to Amazon Simple Email Service (SEs) and Workmail services.
“Javaghost obtained exposed long-term access keys associated with identity and access management (IAM) users who enabled them to gain preliminary access to an AWS environment via the command line (CLI),” the researchers said. “Between 2022-24, the group developed their tactics for more advanced defense scoring techniques trying to obscure identities in the cloudtrail logs. This tactic has historically been exploited by scattered spider.”
After confirming access, attacking would create a temporary account and access the console. Then they would use SEE and Workmail to create their phishing infrastructure and would create SMTP -AdIritimation information to send phishing -e emails.
“Through the time frame of the attacks, Javaghost creates different IAM users, some they use during their attacks and others they never use,” the researchers explained. “The unused IAM users seem to serve as long-term persistence mechanisms.”
As E emails come from a well -known and legitimate device, they would bypass E -mail protection and reach their goals inboxes. They also sound more credible, as the two parties probably also communicated in the past.
