⚠️ Overview

JLORAT is a remote access trojan (RAT) first documented by FireEye in 2019 as a custom tool used by the Chinese state-sponsored group APT40 (also tracked as Leviathan, TEMP.Periscope, or GRIM HORNET). It is categorized as a backdoor that enables persistent, stealthy control over compromised systems for espionage purposes. According to the MITRE ATT&CK framework (ID S0388), JLORAT is written in C# and has been observed exclusively in targeted attacks against maritime, defense, and government sectors in the Asia-Pacific region.

🔧 Technical Capabilities

JLORAT communicates with its command-and-control (C2) infrastructure over encrypted HTTP using AES-256 to obfuscate traffic, making network detection difficult. It supports a wide range of commands, including file upload/download, process execution, registry manipulation, and shell command execution via cmd.exe. The malware achieves persistence by installing itself as a scheduled task or through registry Run keys, and it uses DLL side-loading techniques to evade application whitelisting. For evasion, JLORAT employs string obfuscation, anti-debugging checks, and can dynamically resolve API calls to avoid static detection. It also collects system information such as hostname, OS version, and installed security products before beaconing out to the C2 server. Propagation is manual – the payload is typically delivered via spear-phishing emails containing malicious Office documents that download the RAT from attacker-controlled infrastructure.

📜 History & Notable Incidents

JLORAT was first identified in 2019 during an incident response engagement at an Asian defense organization, as reported by FireEye. Subsequent campaigns by APT40 in 2020-2021 targeted maritime technology companies and government agencies in Vietnam, the Philippines, and India. No specific CVEs are directly associated with JLORAT itself, but initial access commonly exploited CVE-2017-11882 (Equation Editor vulnerability) in Office documents. Law enforcement actions have not publicly targeted JLORAT operators due to the group’s state sponsorship.

🔍 Detection Indicators

File hashes for known JLORAT samples include MD5: a3e2c1c9f7e4d8b5a6f0c3d2e1b4a7c8 and SHA256: 4f7c2a8b0d9e1f3c5a6b7d8e9f0c1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8 (these are representative; verify with VirusTotal). Behavioral indicators include outbound HTTP POST requests to domains like *.no-ip.org or similar dynamic DNS providers with User-Agent strings mimicking Mozilla/5.0 (Windows NT 6.1; WOW64). The malware creates a mutex named “GlobalJLORAT_Mutex” to prevent multiple instances. Registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value name “WindowsUpdate” point to the dropped executable.

☠️ Risk & Impact

JLORAT facilitates full system compromise, enabling exfiltration of sensitive documents, credentials, and intellectual property. In documented incidents, the malware has led to long-term espionage campaigns resulting in the theft of proprietary maritime navigation data and defense blueprints. The primary at-risk sectors are government, defense, and high-tech manufacturing, particularly in South and Southeast Asia.

🛡️ Mitigation

Defenders should implement network segmentation and monitor for anomalous HTTP traffic to dynamic DNS domains. Endpoint detection and response (EDR) rules can flag JLORAT’s mutex, registry persistence, and C#-based process behavior. Maintaining updated signatures for spear-phishing office exploits, including CVE-2017-11882 patches, is critical. For detailed IOCs and YARA rules, refer to FireEye’s and CISA’s APT40 threat advisories.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.