JS.MonoGlyphRAT — JavaScript RAT Delivered via Fake Purchase-Order Phishing Targeting US Enterprises
JS.MonoGlyphRAT (TL-2026-0686), also tracked as JS.MonoGlyphRAT, is a high-severity malware campaign, first published 2026-06-06. It has no confirmed attribution, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1027, T1041, T1047), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0686
- Threat ID
- TL-2026-0686
- Also known as
- JS.MonoGlyphRAT, MonoGlyphRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-06
- Last reviewed
- 2026-06-06
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, mssp, telecommunications, education
- Target regions
- North America, Europe, Oceania
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in JS.MonoGlyphRAT
Malware and tooling: JS.MonoGlyphRAT
JS.MonoGlyphRAT is a previously-unknown JavaScript backdoor delivered through phishing emails carrying .js files disguised as purchase orders, quotes, and business proposals. On execution via wscript.exe it grants silent, persistent remote access, collects host telemetry, and downloads/executes additional payloads (PowerShell and in-memory .NET) over an AES-128-CBC-encrypted HTTP C2 channel. The active campaign primarily targets US technology, MSSP, telecom, and education organizations, with secondary activity in Germany, Sweden, and Australia.
How JS.MonoGlyphRAT works
JS.MonoGlyphRAT is a JavaScript-based remote access trojan first publicly documented by ANY.RUN on 2026-06-02. Initial access is achieved through phishing emails delivering a malicious JavaScript file masquerading as a business document (e.g. 'PURCHASE ORDER_12258.js', 'QUOTE_B2026.js', 'QUOTATION2026115.js'). When the victim double-clicks the file, Windows Script Host (wscript.exe) executes the script directly.
The loader's defining characteristic is 'monoglyph obfuscation': variable and function identifiers are built from long runs of a single repeated character in mixed case (e.g. IiIiIiIiiIII, KkkKKKkKkK), defeating naive static analysis and signature matching. The script leverages WSH bindings for process execution, WMI for host data collection, PowerShell for payload execution, and registry manipulation for persistence. Strings and URLs are stored using reversed hex encoding, and additional layers use Base64 (UTF-16LE) and XOR.
Upon execution the RAT performs a C2 handshake before establishing persistence. It self-copies to %USERPROFILE%\<random>\<random>.js and writes an HKCU ...\CurrentVersion\Run entry with a random single-letter name so the script re-launches at logon. C2 traffic uses HTTP to hosts such as 158.94.211.76:34567 (non-standard port) and 91.92.243.79, plus the domain aryamint.com / scan.aryamint.com, with the endpoint path /ceoznp. Beacons take the form http://<host>/<endpoint>?ia=<session_id>[¶m=value], using query parameters ia, ex, sb, vc, df, kp, tw, fp. Command and session control are carried in custom HTTP headers X-S (session ID) and X-A (command ID). Payloads and telemetry are encrypted with AES-128-CBC using the static IV 'sixteenbyteslong'.
The X-A command set supports client update (-7), uninstall/self-removal (-6), process termination (-5), client restart (-4), connection management (-3..0), download-and-execute encrypted file (1), execute encrypted PowerShell (2), in-memory .NET execution with AMSI bypass (3), and host telemetry collection (4). Telemetry gathered includes USERDOMAIN, USERNAME, chassis serial number, OS caption, total physical memory, system model, CPU and GPU names, and a running-process enumeration, collected via WMI (Win32_SystemEnclosure, Win32_OperatingSystem, Win32_ComputerSystem, Win32_Processor, Win32_VideoController, Win32_Process). Defense evasion includes AMSI bypass via AmsiScanBuffer patching, Base64 UTF-16LE PowerShell '-enc' encoding, reflective in-memory .NET loading to avoid disk writes, and file deletion of dropped artifacts. At time of reporting the malware was undetected/unattributed (classified 'Unknown malware' on VirusTotal and ThreatFox) and detection is primarily behavioral.
MITRE ATT&CK techniques used in TL-2026-0686
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1204 User Execution
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1571 Non-Standard Port
Persistence
T1547 Boot or Logon Autostart Execution
Initial Access
defense-impairment
Affected products and versions in JS.MonoGlyphRAT
- Microsoft — Windows
Vulnerable versions: Windows with Windows Script Host enabled
Remediation for JS.MonoGlyphRAT
Immediate actions
- Block C2 indicators at the perimeter: 158.94.211.76, 91.92.243.79, aryamint.com, scan.aryamint.com
- Alert on outbound HTTP to non-standard port 34567 and to URI path /ceoznp
- Quarantine inbound email attachments with .js extensions; block .js delivery via mail gateway
Workarounds
- Disable Windows Script Host via HKLM\Software\Microsoft\Windows Script Host\Settings\Enabled = 0
- Apply WDAC/AppLocker rules to block script execution from user-writable paths (%USERPROFILE%)
Longer-term hardening
- Change the default handler for .js/.jse files from WScript to Notepad to neutralize double-click execution
- Deploy EDR with behavioral detection for wscript.exe spawning powershell.exe with -enc and for AMSI tampering
- Enable PowerShell script-block and module logging and AMSI; restrict Windows Script Host where not required
Weaknesses (CWE) in JS.MonoGlyphRAT
CWE-506
Timeline of JS.MonoGlyphRAT
- Active in-the-wild campaign observed targeting US technology, MSSP, telecom, and education orgs; secondary activity in Germany, Sweden, Australia.
- C2 IPs (158.94.211.76:34567, 91.92.243.79), domain aryamint.com, endpoint /ceoznp, and two SHA256 sample hashes published.
- Interactive sandbox analysis details monoglyph obfuscation, wscript.exe execution, AES-128-CBC C2, and the X-A command set.
- ANY.RUN publicly documents JS.MonoGlyphRAT, a previously-unknown JavaScript backdoor delivered via fake purchase-order phishing.
- Threadlinqs Intelligence ingests and analyzes the threat; BeaconBeagle returns no existing C2 correlation for the campaign IPs/domain.
Sources cited for JS.MonoGlyphRAT
- From Fake Purchase Orders to Remote Access: Analyzing the JS.MonoGlyphRAT Threat to US Enterprises
- ANY.RUN Cybersecurity Blog
- MITRE ATT&CK T1059.007 — JavaScript
- MITRE ATT&CK T1547.001 — Registry Run Keys / Startup Folder
- MITRE ATT&CK T1620 — Reflective Code Loading
- MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools (AMSI)
Threats related to JS.MonoGlyphRAT
- HTA-Based Cobalt Strike Downloader Script Analysis (CyberChef Deobfuscation)
- TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry
- TonRAT Node.js Implant Campaign — Photo-Themed ZIP/.LNK Lures Target Hospitality Sector for Persistent Access (Waves 1 & 2)
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
- Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and Lumma Stealer to the Retro Gaming / PlayStation Vita Modding Community
- NanoCore RAT VBScript Loader Using Chr()/Math/Flow-Control Obfuscation to Evade Static Detection (CyberChef Analysis)
Detection coverage for TL-2026-0686
As of 2026-06-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0686 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.