⚠️ Overview

jspRAT is a Java-based remote access trojan (RAT) first documented in public threat reports around 2019 by researchers at Palo Alto Networks and later by the AhnLab Security Emergency Response Center (ASEC). It is attributed to the North Korean threat group APT37 (also known as Reaper, ScarCruft, and Group123) and functions as a backdoor capable of executing arbitrary commands on compromised servers, particularly those running Apache Tomcat or JBoss web applications. The malware is typically classified as a RAT that enables persistent remote control and data exfiltration from targeted systems.

🔧 Technical Capabilities

jspRAT is typically deployed by exploiting known vulnerabilities in Java-based web servers, such as CVE-2017-5638 (Apache Struts2 Jakarta multipart parser RCE) and CVE-2019-0232 (Apache Tomcat CGIServlet RCE). It propagates by uploading a JSP web shell to a publicly accessible web directory, allowing the attacker to execute system commands via HTTP GET or POST requests. The malware communicates with its command-and-control (C2) infrastructure over HTTPS, often using legitimate Cloudflare or other CDN services to obfuscate the actual C2 IP address. Persistence is achieved by modifying server configurations, such as adding cron jobs or Windows scheduled tasks, and by overwriting existing legitimate JSP files. Evasion techniques include encoding payloads in Base64, using randomized filenames, and leveraging server-side encryption to avoid signature-based detection. The RAT can enumerate files, upload/download data, execute shell commands, and proxy network connections through the compromised server. According to MITRE ATT&CK, jspRAT maps to techniques T1105 (Ingress Tool Transfer), T1059.007 (Command and Scripting Interpreter: JavaScript/JSP), and T1071.001 (Application Layer Protocol: Web Protocols).

📜 History & Notable Incidents

jspRAT was first publicly documented in June 2019 by Palo Alto Networks Unit 42 in a report on APT37 activity targeting South Korean think tanks and government entities. In early 2020, ASEC reported a campaign using jspRAT against South Korean web hosting companies, exploiting Apache Tomcat vulnerabilities (CVE-2019-0232). A high-profile incident involved the compromise of a South Korean defense contractor in 2020, where jspRAT was used to exfiltrate sensitive military documents. The malware has also been used against academic institutions and media organizations in South Korea, as reported by KISA (Korea Internet & Security Agency). No specific CVEs were exclusively assigned to jspRAT itself; it leverages older server-side CVEs as attack vectors. Law enforcement actions have not been publicly documented, but international sanctions against North Korean cyber groups have been imposed by the United States Treasury's OFAC.

🔍 Detection Indicators

Known file hashes for jspRAT variants include SHA256: 5a6d7e8f... (specific hashes available in Unit 42 reports), but indicators often vary due to randomization. Behavioral signatures include unexpected JSP file creation in web-accessible directories (e.g., /webapps/ROOT/, /usr/local/tomcat/webapps/), and HTTP requests containing parameters like "cmd" or "exec" with Base64-encoded commands. Network IOCs include connections to C2 domains registered through privacy services, such as "jspupdate[.]com" and "javasupport[.]net" (historical). User-Agent strings may mimic legitimate Java clients, e.g., "Java/1.8.0_201". File artifacts often have timestamps matching the server's last restart. No persistent mutex or registry keys are used since jspRAT is primarily file-based on Linux/Unix servers.

☠️ Risk & Impact

jspRAT enables threat actors to gain long-term, stealthy access to vulnerable web servers, leading to data exfiltration of intellectual property, credentials, and confidential documents. The primary impact is on organizations using outdated Java-based web servers, particularly in the government, defense, and technology sectors in East Asia. Financial losses are indirect, usually tied to incident response costs and reputational damage, though direct theft has not been reported. The malware can also serve as a pivot point for lateral movement within a network, increasing the overall risk of a broader compromise.

🛡️ Mitigation

To mitigate jspRAT, organizations should apply security patches for Apache Tomcat, Struts2, and JBoss vulnerabilities (especially CVE-2017-5638 and CVE-2019-0232) immediately, and implement strict file upload validation on web servers. Deploy web application firewalls (WAF) with rules to block suspicious JSP file uploads, and use endpoint detection and response (EDR) tools to monitor for anomalous JSP file creation and outbound HTTPS connections to unknown domains. Regular vulnerability scanning and adherence to the CIS Benchmarks for web servers are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.