Threat actors are executing a targeted social engineering campaign against US-based enterprise environments using fraudulent business documentation, including fake purchase orders and Requests for Proposals (RFPs). The attack vector utilizes malicious JavaScript (.js) loaders embedded within these attachments to deploy the JS.MonoGlyphRAT, a sophisticated Remote Access Trojan designed for stealth and evasion of signature-based detection mechanisms. Upon execution, the malware establishes persistence through Windows Registry modifications or Startup folder manipulation and initiates command-and-control (C2) communication. This campaign facilitates unauthorized remote system access, lateral movement, and potential corporate data exfiltration within compromised networks.

• Campaign Overview
  • Targeted geographic focus on the United States.
  • Primary targets involve high-value enterprise and corporate sectors.
  • Strategic objectives include long-term espionage and lateral network movement.
• Attack Vector and Payload Mechanics
  • Lure delivery via phishing emails containing fake purchase orders, quotes, or RFPs.
  • Initial execution via malicious JavaScript (.js) loaders disguised as legitimate business documents.
  • Deployment of JS.MonoGlyphRAT, a specialized Remote Access Trojan.
  • Use of stealth techniques designed to bypass traditional signature-based security controls.
• Post-Exploitation and Persistence
  • Establishment of covert command-and-control (C2) communication channels.
  • Persistence mechanisms utilizing Windows Registry modifications or Startup folder manipulation.
  • Facilitation of unauthorized remote system control and credential theft.
• Detection and Defensive Challenges
  • Reported low detection rates among traditional, signature-reliant security software.
  • Difficulty in distinguishing malicious .js loaders from legitimate administrative scripts.
  • Requirement for behavioral-based detection and robust EDR/XDR monitoring.
• Mitigation and Strategic Response
  • Implementation of strict attachment filtering for suspicious script-based files.
  • Enhanced user awareness training focusing on high-context business social engineering.
  • Deployment of endpoint monitoring to detect unauthorized registry or startup changes.