Threat Actors Abuse Internet Archive to Host Stealthy JScript Loader

An Malicious actors are using reliable internet resources, such as the Internet Archive, more frequently to disseminate clandestine malware components in a worrying increase in cyberthreats.

This tactic exploits the inherent trustworthiness of such platforms, allowing attackers to bypass traditional security filters and deliver payloads under the guise of legitimate content.

The latest incident highlights a sophisticated delivery chain that begins with a JScript loader and culminates in the deployment of the Remcos Remote Access Trojan (RAT), demonstrating how open-access archives can be weaponized for persistent infections.

Emerging Trend in Malware Delivery Chains

The attack initiates with a JScript loader that executes a PowerShell script, which in turn retrieves a seemingly innocuous PNG image file hosted on the Internet Archive.

This image serves as a covert container for an obfuscated .NET loader, ingeniously encoded within the RGB values of individual pixels in a bitmap embedded in the PNG.

Upon extraction, the PowerShell component launches the .NET loader directly in memory, evading disk-based detection mechanisms commonly employed by antivirus solutions.

This in-memory execution is a hallmark of advanced persistent threats, as it minimizes forensic footprints and complicates static analysis.

Detailed Breakdown of the Infection Process

Once active, the .NET loader establishes persistence on the compromised system by modifying registry keys, ensuring the malware survives reboots and maintains long-term access.

It then proceeds to deploy the final payload: Remcos RAT, a versatile remote access tool known for its capabilities in data exfiltration, keystroke logging, and command execution.

Remcos communicates with its command-and-control (C2) infrastructure via the Duck DNS dynamic DNS provider, which facilitates flexible and resilient domain resolution.

This choice of DynDNS enhances the attack’s evasion potential, as it allows rapid C2 server rotations to avoid blacklisting.

Security researchers at VMRay have analyzed this chain through dynamic behavioral monitoring, revealing key indicators such as anomalous network activity and registry manipulations.

Their report underscores the loader’s heavy obfuscation techniques, including string encryption and dynamic API resolution, which further shield the malware from reverse engineering efforts.

This abuse of the Internet Archive exemplifies a broader pattern where threat actors repurpose legitimate services ranging from cloud storage to code repositories for malware staging.

By embedding payloads in multimedia files like PNGs, attackers exploit the low scrutiny applied to non-executable formats, making detection reliant on advanced behavioral analytics rather than signature-based scanning.

The implications for cybersecurity defenses are significant. Organizations must enhance monitoring for unusual downloads from archival sites and implement stricter controls on script execution, such as constraining PowerShell to constrained language mode.

Moreover, integrating threat intelligence feeds that track emerging abuse vectors can aid in proactive mitigation.

As legitimate platforms continue to be co-opted, this incident serves as a reminder of the evolving cat-and-mouse game between attackers and defenders, where trust in online resources is increasingly a liability.

Indicators of Compromise (IOCs)

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!