Jaku Botnet

The Jaku Botnet is a network of Trojans using compromised PCs for conducting a variety of illicit activities. Although many of these Trojans' attacks may target other machines besides the infected host, a Jaku Botnet Trojan also may install other threats, and has been correlated with illegitimate reconnaissance activities. Malware researchers recommend that all concerned parties monitor their file downloads for potential Jaku Botnet droppers, and remove a Jaku Botnet Trojan with anti-malware products as needed.

Asia in the Grasp of a Trojan's Networked Tentacles

The Jaku Botnet has been under active deployment since fall of 2015. Although hundreds of countries are on this campaign's list of compromised regions, which does not take overly strict steps to limit its infection of new platforms, entities within Japan and South Korea are a clear majority of victims. Various government branches, corporations, and other NGO institutions all have been impacted through the Jaku Botnet's most widely-used infection vector, seeded torrent downloads. There also is a strong correlation between the usage of unlicensed versions of the Windows operating system with the presence of a Jaku Botnet Trojan.

Although the Jaku Botnet has experienced significant growth in its half-year lifespan, its developers (potentially affiliated with the previously-known Lazarus threat actor) have taken various steps for protecting their Trojans from detection. The Jaku Botnet's Trojans incorporate multiple, backup server communication mechanisms, infection monitoring via an obfuscated version of the SQLite library, and a variety of open source code solutions.

For now, malware analysts emphasize the following features as particularly important security risks for any system compromised by the Jaku Botnet:

• A Jaku Botnet Trojan can exploit the resources of infected machines to accomplish common botnet-based attacks, including sending spam or crashing websites via Denial-of-Service floods.
• Along with their personal features, the Jaku Botnet Trojans may supplement their payloads with the capabilities of other threats that they can install arbitrarily. Such functions are most likely of being used to collect information from high-value targets, such as engineering or pharmaceutical administrators.

The Jaku Botnet also has joined the relatively limited number of threatening programs using the art of steganography, or concealing secret information within 'harmless' content like images, for hiding itself. Previously, malware experts associated such exploits with equally high-level threats, such as the backdoor Trojan HAMMERTOSS.

Pulling Your Part of the Plug on the Jaku Botnet

The Jaku Botnet is, by design, meant to siphon the compromised system's resources for harmful acts while showing no symptoms for giving its presence away to any users. However, attentive PC owners may note persistent changes in memory usage, or automated attempts to contact compromised IP addresses, of which the security company of Forcepoint has provided a partial list. Because of this threat's focus on torrent-based distribution methods, avoiding peer-to-peer downloads through applications like BitTorrent can limit its distribution.

The Jaku Botnet's developers are most likely of Korean origin and show a particular interest in compromising valuable targets within that region, but PCs in other nations also are confirmed targets. Doing your part to prevent the flood of spam, DDoS attacks and other, decentralized harmful campaigns requires halting the distribution of responsible threats like the Jaku Botnet Trojans. If you suspect that your PC has become part of the Jaku Botnet, use your automated anti-malware tools for removing the Trojan, and any secondary threat that the Jaku Botnet may install.

However, based on the Trojan's preference for users executing pirated Windows versions, PC users having second thoughts about their preferred methods of acquiring operating systems also may be just as critical a factor in this threat campaign.