An attacker deployed a modular Remote Access Trojan (RAT) and proxy framework leveraging the Deno JavaScript runtime. The attack utilized mailbombing and Microsoft Teams impersonation to facilitate the download of a malicious archive. The implant operates via multiple modular JavaScript files that use specific Deno permission flags to perform C2 communication, local command execution, and network pivoting.
The investigation revealed an initial access phase consisting of email flooding and social engineering via Microsoft Teams. The malware was identified as a non-traditional, modular Deno-based system split into four scripts: app.js, back.js, helper.js, and webui.js. Detection occurred during post-exploitation reconnaissance activities rather than the initial execution.
Organizations should monitor for the execution of scripting runtimes like Deno from user-writable directories and alert on suspicious permission flags such as –allow-run or –allow-net. Implementing monitoring for local loopback HTTP services and correlation of Teams impersonation alerts with email anomalies is recommended. Additionally, restricting the ability to run unsigned or unapproved runtimes can reduce the attack surface.
Upon detection, responders should isolate affected hosts and investigate the source of the Teams impersonation. Analysis should focus on the Deno process lineage and any local services bound to loopback ports 10021 or 10022. Reviewing Microsoft 365 Unified Audit Logs for TeamsImpersonationDetected events is critical for determining the scope of the social engineering campaign.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary has successfully delivered a malicious Deno-based RAT to the victim’s machine via a spearphishing attachment ( T1566.004 ). To evade traditional signature-based AV, the attacker hides the Deno binary within a deep, non-standard subdirectory of the user’s roaming profile: C:Usersuser.nameAppDataRoamingDenoJSEnv . The attacker then executes the binary using the --allow-run and --allow-net flags. This allows the JavaScript-based malware to execute arbitrary shell commands for system discovery ( T1082 ) and communicate with an external C2 server over HTTPS ( T1071.001 ).
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
