{
  "family": "jacksbot",
  "sample_count": 2,
  "category": "trojan",
  "description": "Backdoor:Java/Jacksbot is a sophisticated, cross-platform Remote Access Trojan (RAT) written entirely in Java. Because it relies on the Java Virtual Machine (JVM), a single Jacksbot payload can successfully infect and control Windows, macOS, and Linux systems (`T1059.007`). It is primarily designed for full remote administration, credential theft, and enlisting the compromised machine into a botnet for DDoS attacks.<br><br><b>Understanding Jacksbot (Cross-Platform RAT)</b><br>To an end-user, the infection is invisible, though system performance may degrade during a DDoS attack. For a SOC analyst, Jacksbot is highly concerning because its cross-platform nature allows attackers to pivot seamlessly across mixed-OS environments (e.g., moving from a compromised Windows workstation to a Linux server).<br><br><b>Execution and RAT Mechanics</b><br>Jacksbot is typically distributed via malicious links (Drive-by Downloads) exploiting outdated Java browser plugins, or bundled within pirated software (`.jar` files). Upon execution via the `java.exe` or `javaw.exe` process (`T1059.007`), it establishes persistence specific to the host OS (e.g., Registry Run keys on Windows, `cron` jobs or `init` scripts on Linux). It establishes an encrypted C2 connection, often over IRC or custom TCP protocols. It possesses a vast array of capabilities: remote desktop viewing (VNC), file system manipulation, executing arbitrary shell commands (`T1059.004`), keylogging, and launching UDP/TCP flood attacks against specific targets (`T1498.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and control, plus the liability of the host being used in cyberattacks. Host-based IoCs include EDR alerts for `java.exe` or `javaw.exe` spawning unexpected child processes (like `cmd.exe` or `/bin/sh`), high CPU utilization by the Java process, and the presence of hidden `.jar` files in user directories. Network IoCs include outbound IRC traffic or persistent, encrypted connections to unknown IP addresses on non-standard ports.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Jacksbot and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jacksbot is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jacksbot establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jacksbot typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Jacksbot compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Jacksbot should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Jacksbot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jacksbot frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Jacksbot across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Jacksbot by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.007",
    "T1498.001",
    "T1059.004",
    "T1056.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.007",
      "name": "Command and Scripting Interpreter: JavaScript/JScript (Execution via the Java Virtual Machine)",
      "tactic": "Execution"
    },
    {
      "id": "T1059.004",
      "name": "Command and Scripting Interpreter: Unix Shell (Remote execution capabilities on Linux hosts)",
      "tactic": "Execution"
    },
    {
      "id": "T1498.001",
      "name": "Network Denial of Service: Direct Network Flood (Using the host to participate in DDoS attacks)",
      "tactic": "Impact"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Stealing credentials across operating systems)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the machine immediately to sever the attacker's interactive control and stop any ongoing DDoS participation.",
    "Determine the vector of execution; if a vulnerable Java browser plugin was exploited, mandate updates across the enterprise.",
    "Hunt across the network for the specific C2 IP addresses, as Jacksbot frequently spreads to other OS platforms within the environment.",
    "Assume all credentials present on the machine (stored in browsers, SSH keys on Linux) are compromised and initiate resets."
  ],
  "what_to_avoid": [
    "Do not assume Linux or macOS hosts are immune; Jacksbot is specifically designed to run on any OS with a JVM.",
    "Avoid leaving outdated versions of the Java Runtime Environment (JRE) installed on endpoints."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}