JS.MonoGlyphRAT Targets US Enterprises With Fake Purchase Orders

Key Takeaways

• A new JavaScript-based Remote Access Trojan, JS.MonoGlyphRAT, is actively targeting US enterprises.
• Attackers are using convincing fake purchase orders and quotations as initial lures to deploy the malware.
• The threat bypasses traditional signature-based detection, requiring advanced behavioral monitoring and sandbox analysis.
• Key indicators of compromise include suspicious JavaScript execution, encoded PowerShell commands, and specific HTTP POST traffic patterns.

Sophisticated JS.MonoGlyphRAT Campaign Targets US Enterprises with Fake Purchase Orders

A stealthy new campaign is leveraging a custom JavaScript-based Remote Access Trojan (RAT), dubbed JS.MonoGlyphRAT, to infiltrate US enterprises. Threat actors are deploying the malware through highly deceptive fake purchase orders and quotations, bypassing conventional security measures with advanced obfuscation and execution techniques.

Initial Infection and Execution

The attack chain typically begins with a user opening a malicious JavaScript file disguised as a legitimate business document, such as “PURCHASE ORDER_12258.js” or “QUOTE_B2026.js”. These files, like the sample identified with SHA256 hash 5446b24959c1c2707accfc257aaac61819c01d1ed65bca910a7e8be1787d20b, are heavily obfuscated. Once executed, the malware establishes persistence by creating new registry run keys, typically in HKCUSoftwareMicrosoftWindowsCurrentVersionRun<random>, pointing to a JavaScript file installed in the user’s profile directory (e.g., %USERPROFILE%<random letters><random letters>.js).

Command and Control Communication

JS.MonoGlyphRAT communicates with its command and control (C2) servers using distinct HTTP POST requests. These requests often feature a unique pattern in the POST body, specifically a=iz&b=<data>. C2 communication also utilizes specific HTTP headers, such as X-A: for command delivery and X-S: for session identification. The malware employs query parameters like ia=<session_id> for session identification, df=0 for telemetry uploads, ex=<token> for file downloads, sb=<token> for loader/stage functionality, and vc=<token> for payload URLs.

Primary C2 infrastructure identified includes IP addresses 158.94.211.76 and 91.92.243.79, with associated domains such as aryamint.com and scan.aryamint.com. Beacon endpoints include hxxp://158.94.211.76:34567/ceoznp.

Detection Evasion and Indicators of Compromise

This threat is designed to evade traditional signature-based detection. Its reliance on JavaScript execution and encoded PowerShell commands necessitates advanced behavioral monitoring and sandbox-based analysis for effective identification. Key indicators of compromise (IoCs) include instances of wscript.exe executing JavaScript files from user directories, PowerShell processes launched with encoded command flags, and unusual HTTP POST traffic to non-standard ports exhibiting the aforementioned patterns.

The malware utilizes a static AES initialization vector (IV), “sixteenbyteslong” (plaintext), which appears in reversed hex encoding as 76E6F6C63756479726E6565647879637. This detail can be crucial for decrypting C2 communications.

Security analysts can leverage Suricata rules with IDs 85006579, 85006580, and 85006581 to detect the specific C2 traffic patterns associated with JS.MonoGlyphRAT.

What You Should Do

• Enhance Email Security: Implement robust email filtering solutions to detect and block malicious attachments, particularly JavaScript files, even if they appear to originate from trusted senders.
• Strengthen Endpoint Detection and Response (EDR): Deploy EDR solutions capable of behavioral analysis to detect suspicious process execution, such as wscript.exe launching JavaScript from user directories or encoded PowerShell commands.
• Implement Network Monitoring: Monitor network traffic for connections to known C2 IP addresses (158.94.211.76, 91.92.243.79) and domains (aryamint.com, scan.aryamint.com), as well as the specific HTTP POST patterns (a=iz&b=) and C2 session parameters.
• Educate Users: Conduct regular cybersecurity awareness training for employees, emphasizing the dangers of opening unsolicited attachments, even those disguised as legitimate business documents like purchase orders or quotations.
• Utilize Sandbox Environments: Analyze suspicious files in a secure sandbox environment before allowing them into the production network to identify malicious behavior.
• Patch and Update: Ensure all operating systems, applications, and security software are kept up to date to mitigate known vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.