{
  "family": "jacksbot",
  "sample_count": 2,
  "category": "trojan",
  "description": "Backdoor:Java/Jacksbot is a sophisticated, cross-platform Remote Access Trojan (RAT) written entirely in Java. Because it relies on the Java Virtual Machine (JVM), a single Jacksbot payload can successfully infect and control Windows, macOS, and Linux systems (`T1059.007`). It is primarily designed for full remote administration, credential theft, and enlisting the compromised machine into a botnet for DDoS attacks.<br><br><b>Understanding Jacksbot (Cross-Platform RAT)</b><br>To an end-user, the infection is invisible, though system performance may degrade during a DDoS attack. For a SOC analyst, Jacksbot is highly concerning because its cross-platform nature allows attackers to pivot seamlessly across mixed-OS environments (e.g., moving from a compromised Windows workstation to a Linux server).<br><br><b>Execution and RAT Mechanics</b><br>Jacksbot is typically distributed via malicious links (Drive-by Downloads) exploiting outdated Java browser plugins, or bundled within pirated software (`.jar` files). Upon execution via the `java.exe` or `javaw.exe` process (`T1059.007`), it establishes persistence specific to the host OS (e.g., Registry Run keys on Windows, `cron` jobs or `init` scripts on Linux). It establishes an encrypted C2 connection, often over IRC or custom TCP protocols. It possesses a vast array of capabilities: remote desktop viewing (VNC), file system manipulation, executing arbitrary shell commands (`T1059.004`), keylogging, and launching UDP/TCP flood attacks against specific targets (`T1498.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and control, plus the liability of the host being used in cyberattacks. Host-based IoCs include EDR alerts for `java.exe` or `javaw.exe` spawning unexpected child processes (like `cmd.exe` or `/bin/sh`), high CPU utilization by the Java process, and the presence of hidden `.jar` files in user directories. Network IoCs include outbound IRC traffic or persistent, encrypted connections to unknown IP addresses on non-standard ports.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.007",
    "T1498.001",
    "T1059.004",
    "T1056.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.007",
      "name": "Command and Scripting Interpreter: JavaScript/JScript (Execution via the Java Virtual Machine)",
      "tactic": "Execution"
    },
    {
      "id": "T1059.004",
      "name": "Command and Scripting Interpreter: Unix Shell (Remote execution capabilities on Linux hosts)",
      "tactic": "Execution"
    },
    {
      "id": "T1498.001",
      "name": "Network Denial of Service: Direct Network Flood (Using the host to participate in DDoS attacks)",
      "tactic": "Impact"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Stealing credentials across operating systems)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the machine immediately to sever the attacker's interactive control and stop any ongoing DDoS participation.",
    "Determine the vector of execution; if a vulnerable Java browser plugin was exploited, mandate updates across the enterprise.",
    "Hunt across the network for the specific C2 IP addresses, as Jacksbot frequently spreads to other OS platforms within the environment.",
    "Assume all credentials present on the machine (stored in browsers, SSH keys on Linux) are compromised and initiate resets."
  ],
  "what_to_avoid": [
    "Do not assume Linux or macOS hosts are immune; Jacksbot is specifically designed to run on any OS with a JVM.",
    "Avoid leaving outdated versions of the Java Runtime Environment (JRE) installed on endpoints."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}