{
  "family": "adwind",
  "sample_count": 6,
  "category": "trojan",
  "description": "Backdoor:Java/Adwind (also known as AlienSpy, Frutas, and jRAT) is a highly prolific, commercially available **Remote Access Trojan (RAT)** written entirely in the Java programming language. Because it relies on the Java Virtual Machine (JVM), Adwind is fundamentally **cross-platform**. A single malicious `.jar` file can seamlessly execute and infect Windows, macOS, Linux, and even Android environments without requiring the attacker to recompile the payload.<br><br><b>Understanding the Adwind Threat</b><br>To an end-user, the infection is typically invisible, occurring after opening a deceptive email attachment. For an enterprise, Adwind represents a total compromise of the affected endpoint, granting the attacker full, interactive control. It is frequently sold as Malware-as-a-Service (MaaS) on underground forums, making it accessible to both low-level cybercriminals and advanced APT groups.<br><br><b>Execution and Cross-Platform Surveillance</b><br>Adwind is heavily distributed via massive spam campaigns (`T1566.001`), often disguised as invoices or shipping documents (e.g., `invoice.jar`). When the user executes the file (assuming Java is installed) (`T1204.002`), Adwind unpacks itself in memory. It establishes persistence appropriate to the host OS (e.g., Registry Run keys on Windows, `LaunchAgents` on macOS) (`T1547.001`). Once active, it connects to a C2 server (often utilizing dynamic DNS) (`T1071.001`). The attacker can then utilize the RAT's extensive features: keylogging (`T1056.001`), stealing saved passwords from browsers and FTP clients (`T1555`), capturing webcam/microphone streams (`T1125`), and downloading additional modules.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the complete loss of confidentiality and control over the endpoint. Host-based IoCs include EDR alerts for `java.exe` or `javaw.exe` spawning unexpected child processes or making anomalous outbound network connections. The presence of hidden `.jar` or `.class` files in the `%AppData%` or `~/Library/Application Support` directories is a strong indicator. Network IoCs include encrypted TCP traffic over non-standard ports communicating with known dynamic DNS providers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1071.001",
    "T1056.001",
    "T1125"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 Communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1125",
      "name": "Video/Audio Capture",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the attacker's interactive control session.",
    "Force a password reset for all corporate accounts used on the machine, as the keylogger likely captured them.",
    "Verify the infection vector (usually email) and purge the malicious `.jar` attachment from all corporate inboxes to prevent lateral spread.",
    "Consider uninstalling the Java Runtime Environment (JRE) from all endpoints that do not strictly require it for business operations."
  ],
  "what_to_avoid": [
    "Do not assume macOS or Linux endpoints are immune; Adwind's primary strength is its ability to infect any OS with Java installed.",
    "Avoid relying solely on file hashes, as Adwind builders allow attackers to easily generate unique, obfuscated `.jar` files."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}