forge-jsx

Threat types

Malicious versions

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28
• 1.0.29
• 1.0.30
• 1.0.31
• 1.0.32
• 1.0.33
• 1.0.34
• 1.0.35
• 1.0.36
• 1.0.37
• 1.0.38
• 1.0.39
• 1.0.40
• 1.0.41
• 1.0.42
• 1.0.43
• 1.0.44
• 1.0.45
• 1.0.46
• 1.0.47
• 1.0.48
• 1.0.49
• 1.0.50
• 1.0.51
• 1.0.52
• 1.0.53
• 1.0.54
• 1.0.55
• 1.0.56
• 1.0.57
• 1.0.58
• 1.0.59
• 1.0.60
• 1.0.61
• 1.0.62
• 1.0.63
• 1.0.64
• 1.0.65
• 1.0.66 · 4cb96c3b033c1aaf…

Campaigns

• forge-jsx RATattributed-to

Indicators

• domain204.10.194.247communicates-with
• ipv4204.10.194.247communicates-with
• sha2564cb96c3b033c1aaf7b3d0fe54749058f14d4d914947a6d6d430aca108a7daa5aindicates
• email[email protected]exfiltrates-to
• email[email protected]exfiltrates-to

Techniques

• ttpT1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Toolsuses
• ttpT1059.007 Command and Scripting Interpreter: JavaScriptuses
• ttpT1552.001 Unsecured Credentials: Credentials In Filesuses
• ttpT1041 Exfiltration Over C2 Channeluses
• ttpT1105 Ingress Tool Transferuses
• ttpT1071.001 Application Layer Protocol: Web Protocolsuses
• ttpT1546 Event Triggered Executionuses