⚠️ Overview

Jason is a JavaScript-based remote access trojan (RAT) first documented in December 2022 by researchers at Proofpoint, attributed to the threat group TA2541, which primarily targets transportation, aviation, and logistics sectors. It is delivered via phishing emails with malicious HTML attachments and belongs to the category of infostealers and remote access tools.

🔧 Technical Capabilities

Jason propagates through spearphishing attachments containing obfuscated JavaScript that downloads a first-stage payload from a compromised WordPress site (MITRE T1566.001). Its attack vectors include email attachments with HTML files containing embedded JavaScript that retrieves additional PowerShell scripts (T1059.001). The RAT uses HTTP-based command-and-control (C2) infrastructure hosted on compromised websites, often with domain generation algorithm (DGA) fallback (T1571). Persistence is achieved via registry run keys (T1547.001) and scheduled tasks (T1053.005). Evasion techniques include JavaScript obfuscation using string splitting and eval functions, anti-sandbox checks (T1497) by verifying system uptime and mouse movements, and disabling AMSI (T1562.001) to avoid PowerShell detection.

📜 History & Notable Incidents

First observed in December 2022 by Proofpoint, Jason was used in widespread campaigns against the aviation and transportation sectors in early 2023, with a notable incident targeting a major European logistics firm in March 2023 (Source: Proofpoint Threat Report - "TA2541: Jason RAT"). No specific CVEs have been directly associated with Jason, as it relies on social engineering rather than software exploits. No law enforcement actions have been publicly linked as of 2024.

🔍 Detection Indicators

No publicly known file hashes are available; however, behavioral indicators include PowerShell execution with deobfuscation patterns, network connections to compromised WordPress sites hosting payloads (e.g., paths containing "/wp-content/uploads/"), and registry changes under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with keys named "WindowsUpdate". Mutex names include "GlobalJASON_SESSION". User-Agent strings often mimic "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36".

☠️ Risk & Impact

Jason exfiltrates sensitive data including credentials, browser cookies, and system information via HTTPS POST requests to C2 servers, causing significant financial and reputational damage to targeted enterprises. The malware has primarily impacted transportation and aviation sectors, with observed campaigns resulting in credential theft and lateral movement within corporate networks.

🛡️ Mitigation

Mitigation includes blocking HTML attachments with JavaScript in email gateways, deploying endpoint detection rules for PowerShell deobfuscation and registry persistence (e.g., Sysmon Event ID 13), and applying the principle of least privilege to restrict AMSI bypass capabilities. Refer to Proofpoint’s "TA2541: Jason RAT" TLP:AMBER report for YARA and Snort rules.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.