Procedure examples

Indrik Spider has used malicious JavaScript files for several components of their attack.

Kimsuky has used JScript for logging and downloading additional tools. Kimsuky has used TRANSLATEXT, which contained four Javascript files for bypassing defenses, collecting sensitive information and screenshots, and exfiltrating data.

TA577 has used JavaScript to execute additional malicious payloads.

Evilnum has used malicious JavaScript files on the victim's machine.

APT32 has used JavaScript for drive-by downloads and C2 communications.

MuddyWater has used JavaScript files to execute its POWERSTATS payload.

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.

Leafminer infected victims using JavaScript code.

FIN7 used JavaScript scripts to help perform tasks on the victim's machine.

Sidewinder has used JavaScript to drop and execute malware loaders.

Mustang Panda has executed a JavaScript payload utilizing wscript.exe on the endpoint.

Contagious Interview has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js.

Higaisa used JavaScript to execute additional files.

Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.

MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.

Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.

Turla has used various JavaScript-based backdoors.

TA505 has used JavaScript for code execution.

Star Blizzard has used JavaScript to redirect victim traffic from an adversary controlled server to a server hosting the Evilginx phishing framework.

TA578 has used JavaScript files in malware execution chains.

LazyScripter has used JavaScript in its attacks.

APT-C-36 has used a fileless attack chain composed of three JavaScript code snippets to execute subsequent payloads.

Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.

Silence has used JS scripts.

Cobalt Group has executed JavaScript scriptlets on the victim's machine.

Molerats used various implants, including those built with JS, on target machines.

TeamPCP has used the JavaScript runtime for malware delivery and injected malicious JavaScript into OpenVSX extensions.

ShinyHunters has used the MeshCentral command-line interface utility meshctrl.js and npm to interact with compromised systems. Specifically for npm, ShinyHunters has checked for the authenticode tool using the command `npm list global authenticode`. Additionally, ShinyHunters has used the MeshCentral command to execute the propagation script: ` node meshctrl.js RunCommand --loginuser admin --loginpass '[password]' --id '[agent_id]' --run 'bash /tmp/[victim_abbreviation]_fanout.sh' `.