Command and Scripting Interpreter: JavaScript

AppleSeed has the ability to use JavaScript to execute PowerShell.^[10]

APT32 has used JavaScript for drive-by downloads and C2 communications.^[11][12]

Astaroth uses JavaScript to perform its core functionalities. ^[13][14]

Avaddon has been executed through a malicious JScript downloader.^[15][16]

Bundlore can execute JavaScript by injecting it into the victim's browser.^[17]

During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.^[18]

During C0017, APT41 deployed JScript web shells on compromised systems.^[19]

Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.^[20]

Cobalt Group has executed JavaScript scriptlets on the victim's machine.^{[21][22][23][24][25][26]}

The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.^[27]

DarkWatchman uses JavaScript to perform its core functionalities.^[28]

Donut can generate shellcode outputs that execute via JavaScript or JScript.^[29]

Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.^[30]

EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.^[31]

Evilnum has used malicious JavaScript files on the victim's machine.^[32]

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.^[33]

FIN7 used JavaScript scripts to help perform tasks on the victim's machine.^[34][35][34]

FRP can support the use of a JSON configuration file.^[36]

Gootloader can execute a Javascript file for initial infection.^[37][38]

GRIFFON is written in and executed as JavaScript.^[39]

Higaisa used JavaScript to execute additional files.^[40][41][42]

Indrik Spider has used malicious JavaScript files for several components of their attack.^[43]

InvisiMole can use a JavaScript file as part of its execution chain.^[44]

jRAT has been distributed as HTA files with JScript.^[45]

JSS Loader can download and execute JavaScript files.^[46]

Kimsuky has used JScript for logging and downloading additional tools.^[47][48]

KONNI has executed malicious JavaScript code.^[49]

KOPILUWAK had used Javascript to perform its core functions.^[50]

Latrodectus has used JavaScript files as part its infection chain during malicious spam email campaigns.^[51][52][53]

LazyScripter has used JavaScript in its attacks.^[54]

Leafminer infected victims using JavaScript code.^[55]

Metamorfo includes payloads written in JavaScript.^[56]

Molerats used various implants, including those built with JS, on target machines.^[57]

MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.^[58]

MuddyWater has used JavaScript files to execute its POWERSTATS payload.^[59][60][61]

NanHaiShu executes additional Jscript code on the victim's machine.^[62]

During Operation Dust Storm, the threat actors used JavaScript code.^[63]

Pikabot Distribution February 2024 utilized obfuscated JavaScript files for initial Pikabot payload download.^[64]

POWERSTATS can use JavaScript code for execution.^[59]

The QakBot web inject module can inject Java Script into web banking pages visited by the victim.^[65][66]

Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.^[67]

Sidewinder has used JavaScript to drop and execute malware loaders.^[68][69]

Silence has used JS scripts.^[70]

The SocGholish payload is executed as JavaScript.^{[71][72][73][74]}

SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.^[75]

Star Blizzard has used JavaScript to redirect victim traffic from an adversary controlled server to a server hosting the Evilginx phishing framework.^[76]

TA505 has used JavaScript for code execution.^[77][78]

TA577 has used JavaScript to execute additional malicious payloads.^[79]

TA578 has used JavaScript files in malware execution chains.^[79]

Turla has used various JavaScript-based backdoors.^[80]

Valak can execute JavaScript containing configuration data for establishing persistence.^[81]

WARPWIRE is a credential harvester written in JavaScript.^[82]

Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.^[83]

Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.^[84]

Xbash can execute malicious JavaScript payloads on the victim’s machine.^[85]

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content ^[86].

Turn off or restrict access to unneeded scripting components.

Denylist scripting where appropriate.

Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.