# JS.MonoGlyphRAT — JavaScript RAT Delivered via Fake Purchase-Order Phishing Targeting US Enterprises

> JS.MonoGlyphRAT is a previously-unknown JavaScript backdoor delivered through phishing emails carrying .js files disguised as purchase orders, quotes, and business proposals. On execution via wscript.exe it grants silent, persistent remote access, collects host telemetry, and downloads/executes additional payloads (PowerShell and in-memory .NET) over an AES-128-CBC-encrypted HTTP C2 channel. The active campaign primarily targets US technology, MSSP, telecom, and education organizations, with secondary activity in Germany, Sweden, and Australia.

- **Published:** 2026-06-06T00:00:00Z
- **Last reviewed:** 2026-06-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0686
- **ID:** TL-2026-0686
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

JS.MonoGlyphRAT is a JavaScript-based remote access trojan first publicly documented by ANY.RUN on 2026-06-02. Initial access is achieved through phishing emails delivering a malicious JavaScript file masquerading as a business document (e.g. 'PURCHASE ORDER_12258.js', 'QUOTE_B2026.js', 'QUOTATION2026115.js'). When the victim double-clicks the file, Windows Script Host (wscript.exe) executes the script directly.

The loader's defining characteristic is 'monoglyph obfuscation': variable and function identifiers are built from long runs of a single repeated character in mixed case (e.g. IiIiIiIiiIII, KkkKKKkKkK), defeating naive static analysis and signature matching. The script leverages WSH bindings for process execution, WMI for host data collection, PowerShell for payload execution, and registry manipulation for persistence. Strings and URLs are stored using reversed hex encoding, and additional layers use Base64 (UTF-16LE) and XOR.

Upon execution the RAT performs a C2 handshake before establishing persistence. It self-copies to %USERPROFILE%\<random>\<random>.js and writes an HKCU ...\CurrentVersion\Run entry with a random single-letter name so the script re-launches at logon. C2 traffic uses HTTP to hosts such as 158.94.211.76:34567 (non-standard port) and 91.92.243.79, plus the domain aryamint.com / scan.aryamint.com, with the endpoint path /ceoznp. Beacons take the form http://<host>/<endpoint>?ia=<session_id>[&param=value], using query parameters ia, ex, sb, vc, df, kp, tw, fp. Command and session control are carried in custom HTTP headers X-S (session ID) and X-A (command ID). Payloads and telemetry are encrypted with AES-128-CBC using the static IV 'sixteenbyteslong'.

The X-A command set supports client update (-7), uninstall/self-removal (-6), process termination (-5), client restart (-4), connection management (-3..0), download-and-execute encrypted file (1), execute encrypted PowerShell (2), in-memory .NET execution with AMSI bypass (3), and host telemetry collection (4). Telemetry gathered includes USERDOMAIN, USERNAME, chassis serial number, OS caption, total physical memory, system model, CPU and GPU names, and a running-process enumeration, collected via WMI (Win32_SystemEnclosure, Win32_OperatingSystem, Win32_ComputerSystem, Win32_Processor, Win32_VideoController, Win32_Process). Defense evasion includes AMSI bypass via AmsiScanBuffer patching, Base64 UTF-16LE PowerShell '-enc' encoding, reflective in-memory .NET loading to avoid disk writes, and file deletion of dropped artifacts. At time of reporting the malware was undetected/unattributed (classified 'Unknown malware' on VirusTotal and ThreatFox) and detection is primarily behavioral.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1620 Reflective Code Loading
- T1547 Boot or Logon Autostart Execution
- T1082 System Information Discovery
- T1057 Process Discovery
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1132 Data Encoding
- T1041 Exfiltration Over C2 Channel
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal

## Sources

- [From Fake Purchase Orders to Remote Access: Analyzing the JS.MonoGlyphRAT Threat to US Enterprises](https://any.run/cybersecurity-blog/monoglyphrat/)
- [ANY.RUN Cybersecurity Blog](https://any.run/cybersecurity-blog/)
- [MITRE ATT&CK T1059.007 — JavaScript](https://attack.mitre.org/techniques/T1059/007/)
- [MITRE ATT&CK T1547.001 — Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
- [MITRE ATT&CK T1620 — Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools (AMSI)](https://attack.mitre.org/techniques/T1562/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0686