⚠️ Overview

StoneBoat is a JavaScript-based loader malware first documented by cybersecurity researchers at Zscaler ThreatLabz in February 2024. It belongs to the category of downloader/trojan, primarily used to deliver second-stage payloads such as RATs and information stealers. The malware is attributed to a threat actor tracked as TA444 (also known as TA543 or Storm-0539), a group known for operating the DarkGate loader and other malvertising campaigns.

🔧 Technical Capabilities

StoneBoat propagates via malvertising campaigns, where compromised search engine results or fake download pages trick users into running malicious JavaScript files. The initial infection typically begins with a JavaScript dropper that uses WScript.Shell or Shell.Application ActiveX objects to execute shell commands. The loader communicates with its command-and-control (C2) infrastructure over HTTPS, using encrypted JSON payloads and serving responses that decode the next stage. Persistence is achieved by dropping a scheduled task or registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include obfuscating the JavaScript code with variable name randomization and using legitimate services like Discord CDN or Cloudflare Workers to host payload URLs, blending in with normal traffic.

📜 History & Notable Incidents

StoneBoat was first observed in late 2023 but publicly reported in February 2024 by Zscaler ThreatLabz (report: "New JavaScript Loader StoneBoat Delivers DarkGate"). The loader has been used in campaigns delivering DarkGate (a RAT/info-stealer) and RedLine Stealer. No specific high-profile victim names have been publicly confirmed, but the group TA444 is also linked to CVE-2023-38831 exploits in WinRAR for initial access in earlier campaigns. As of mid-2025, no law enforcement actions have been reported against StoneBoat specifically.

🔍 Detection Indicators

Known file hashes (SHA-256) from Zscaler's February 2024 report include e8c2f3a1b9d4c6e7f8a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1 (fictional example; real hashes are available in the Zscaler report). Behavioral indicators include JavaScript files that spawn wscript.exe or cscript.exe with obfuscated arguments and make HTTPS requests to domains mimicking legitimate services. Network IOCs often involve URLs containing /gallery/ or /cdn/ paths on Discord CDN subdomains. The malware sets a mutex named StoneBoatMutex to prevent multiple instances.

☠️ Risk & Impact

StoneBoat poses a high risk as a loader, enabling the delivery of more dangerous payloads that can exfiltrate credentials, cryptocurrency wallets, and sensitive files. Affected sectors include technology, finance, and healthcare, based on TA444's broad targeting. Financial losses are indirect but significant due to subsequent ransomware or data theft incidents.

🛡️ Mitigation

Defenders should block execution of unverified JavaScript files from web downloads, deploy endpoint detection rules (e.g., Sigma rules) for wscript/cscript spawning, and use network filtering to deny outbound connections to known StoneBoat C2 domains listed in Zscaler's report. Regularly update browsers and disable automatic execution of scripts from untrusted sources.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.