Executive Summary
JS.MonoGlyphRAT is a newly identified, sophisticated JScript backdoor currently targeting US-based organizations in the technology, telecommunications, and education sectors. The malware is typically delivered via phishing emails containing malicious JavaScript attachments disguised as business documents like purchase orders or quotes. Its name is derived from a unique 'monoglyph' obfuscation technique, where variable and function names consist of repeated characters in mixed case, effectively bypassing many signature-based security tools.
Technically, the RAT operates via Windows Script Host (WSH) and establishes persistence through the Windows Registry. It features a robust command-and-control (C2) protocol using custom HTTP headers (X-S, X-A) to receive tasks such as host telemetry collection, arbitrary PowerShell execution, and in-memory .NET reflective loading. The malware is designed for long-term persistence and functions as a flexible loader capable of delivering follow-on payloads such as ransomware.
This threat poses a significant risk due to its high evasion capabilities and focus on critical enterprise targets. Successful infection can lead to data exfiltration, business email compromise, and operational disruption. Organizations should prioritize behavioral detection and sandbox analysis to identify this threat, as static signatures remain unreliable.