Jacksbot

Overview

Backdoor:Java/Jacksbot is a sophisticated, cross-platform Remote Access Trojan (RAT) written entirely in Java. Because it relies on the Java Virtual Machine (JVM), a single Jacksbot payload can successfully infect and control Windows, macOS, and Linux systems (`T1059.007`). It is primarily designed for full remote administration, credential theft, and enlisting the compromised machine into a botnet for DDoS attacks.

Understanding Jacksbot (Cross-Platform RAT)
To an end-user, the infection is invisible, though system performance may degrade during a DDoS attack. For a SOC analyst, Jacksbot is highly concerning because its cross-platform nature allows attackers to pivot seamlessly across mixed-OS environments (e.g., moving from a compromised Windows workstation to a Linux server).

Execution and RAT Mechanics
Jacksbot is typically distributed via malicious links (Drive-by Downloads) exploiting outdated Java browser plugins, or bundled within pirated software (`.jar` files). Upon execution via the `java.exe` or `javaw.exe` process (`T1059.007`), it establishes persistence specific to the host OS (e.g., Registry Run keys on Windows, `cron` jobs or `init` scripts on Linux). It establishes an encrypted C2 connection, often over IRC or custom TCP protocols. It possesses a vast array of capabilities: remote desktop viewing (VNC), file system manipulation, executing arbitrary shell commands (`T1059.004`), keylogging, and launching UDP/TCP flood attacks against specific targets (`T1498.001`).

Indicators of Compromise & Impact
The impact is total loss of confidentiality and control, plus the liability of the host being used in cyberattacks. Host-based IoCs include EDR alerts for `java.exe` or `javaw.exe` spawning unexpected child processes (like `cmd.exe` or `/bin/sh`), high CPU utilization by the Java process, and the presence of hidden `.jar` files in user directories. Network IoCs include outbound IRC traffic or persistent, encrypted connections to unknown IP addresses on non-standard ports.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1059.004: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1059.007: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_JACKSBOT {
    meta:
        description = "Detects Jacksbot (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "jacksbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Jacksbot Activity
id: 6c8e4b9dbd729a01566d60d254ae9914
status: experimental
description: Detects generic indicators of the jacksbot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*jacksbot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the machine immediately to sever the attacker's interactive control and stop any ongoing DDoS participation.
2. Determine the vector of execution; if a vulnerable Java browser plugin was exploited, mandate updates across the enterprise.
3. Hunt across the network for the specific C2 IP addresses, as Jacksbot frequently spreads to other OS platforms within the environment.
4. Assume all credentials present on the machine (stored in browsers, SSH keys on Linux) are compromised and initiate resets.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume Linux or macOS hosts are immune; Jacksbot is specifically designed to run on any OS with a JVM.
2. Avoid leaving outdated versions of the Java Runtime Environment (JRE) installed on endpoints.

References & External Analysis

• Search "jacksbot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Equationdrug
• Spypro
• Gamaredon
• Trash
• Pwszbot

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/jacksbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.