JDownloader Website Supply-Chain Compromise Distributes Trojanized Installers (Python RAT / Linux Persistence Malware)

Key facts for JDownloader r77 installer hijack

Detection coverage for JDownloader r77 installer hijack

As of 2026-07-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1142 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: JDownloader Campaign — WDAC/SIPolicy AV-Tampering, r77 Rootkit Injection & Linux SUID Persistence (SPL)

Detects the post-exploitation persistence/privilege-escalation/defense-evasion stage: malicious WDAC SIPolicy.p7b deployment that disables security vendors, RC4/hex-encoded bot configuration written to HKCU\SOFTWARE\Python, r77 rootkit DLL injection into winlogon.exe, and the Linux SUID-root systemd-exec binary plus /etc/profile.d persistence script masquerading as /usr/libexec/upowerd.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1685, T1112, T1055.001, T1014, T1548.001, T1037.004, T1036.005
• Data sources: sysmon, windows_security, linux_audit, edr_file_events, edr_registry_events
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
( (EventCode=11 TargetFilename="*\\System32\\CodeIntegrity\\SIPolicy.p7b")
  OR (EventCode=13 TargetObject="*\\SOFTWARE\\Python\\*" Details!="")
  OR (EventCode=8 TargetImage="*\\winlogon.exe") )
| eval technique=case(EventCode=11, "T1685 WDAC/AV Tamper", EventCode=13, "T1112 Registry Bot Config", EventCode=8, "T1055.001 DLL Injection - winlogon.exe")
| where NOT (EventCode=11 AND (Image="*\\TrustedInstaller.exe" OR Image="*\\ConfigCI.dll" OR Image="*\\dism.exe"))
| table _time, ComputerName, EventCode, technique, Image, SourceImage, TargetImage, TargetFilename, TargetObject, Details
| append
    [ search index=linux_audit sourcetype=auditd
        ( (path="/usr/bin/systemd-exec" (perm="*s*" OR mode="*4755*"))
          OR (path="/etc/profile.d/systemd.sh")
          OR (comm="upowerd" NOT exe="/usr/lib/upower/upowerd" NOT exe="/usr/libexec/upowerd") )
      | table _time, host, path, perm, mode, comm, exe ]
| sort - _time

Microsoft KQL

let WinSIPolicy =
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has @"System32\CodeIntegrity\SIPolicy.p7b"
    | where InitiatingProcessFileName !in~ ("TrustedInstaller.exe","ConfigCI.exe","dism.exe")
    | project Timestamp, DeviceName, ActionType, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, Technique = "T1562.001";
let WinRegistry =
    DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey has @"SOFTWARE\Python" and RegistryValueData matches regex @"^[0-9A-Fa-f]{40,}$"
    | project Timestamp, DeviceName, ActionType, FolderPath = RegistryKey, InitiatingProcessFileName, InitiatingProcessCommandLine = RegistryValueData, InitiatingProcessAccountName, Technique = "T1112";
let LinuxPersist =
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath in ("/usr/bin/systemd-exec","/etc/profile.d/systemd.sh")
    | project Timestamp, DeviceName, ActionType, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, Technique = "T1548.001/T1037.004";
WinSIPolicy
| union WinRegistry
| union LinuxPersist
| sort by Timestamp desc

Sigma

title: Unauthorized SUID-Root Binary "systemd-exec" Created Outside Package Manager
id: 7a2d4f10-9c33-4e6b-8f21-a1b2c3d4e002
status: experimental
description: Detects creation of a SUID-root binary named systemd-exec in /usr/bin, matching the persistence mechanism dropped by the trojanized JDownloader Linux shell installer, along with its companion /etc/profile.d login-persistence script and process masquerading as /usr/libexec/upowerd.
references:
    - https://www.gendigital.com/blog/insights/research/inside-the-jdownloader-supply-chain-attack
    - TL-2026-1142
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-06
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.defense-evasion
    - attack.t1548.001
    - attack.t1037.004
    - attack.t1036.005
logsource:
    category: file_event
    product: linux
detection:
    selection_suid_binary:
        file_path|startswith: '/usr/bin/'
        file_name: 'systemd-exec'
    selection_persist_script:
        file_path: '/etc/profile.d/systemd.sh'
    condition: selection_suid_binary or selection_persist_script
falsepositives:
    - Legitimate systemd-related tooling coincidentally named systemd-exec installed via a trusted package manager (verify package provenance with dpkg -S / rpm -qf)
level: high

Known false positives:

• Legitimate WDAC policy deployments pushed by TrustedInstaller.exe, ConfigCI.exe, dism.exe, or an authorized MDM/Intune WDAC management workflow
• Third-party Python interpreters or dev tooling that legitimately write configuration values under HKCU\SOFTWARE\Python (verify the value is not RC4/XOR-obfuscated bot config format)
• Custom-built systemd-adjacent tooling named systemd-exec installed and tracked by the organization's package manager

Tuning notes: Baseline the organization's legitimate WDAC policy update process (owner/service accounts, change-ticket references) and exclude those initiating processes; tune the registry selector's hex-length/entropy threshold to reduce noise from legitimate long configuration blobs; verify every Linux SUID hit against package-manager provenance (dpkg -S / rpm -qf) before escalating.

• 🔒 JDownloader Trojanized Installer Execution — Untrusted Publisher & Fraudulent Code Signature (KQL) · unlock with TL Creds
• 🔒 JDownloader Campaign — WDAC/SIPolicy AV-Tampering, r77 Rootkit Injection & Linux SUID Persistence (KQL) · unlock with TL Creds
• 🔒 JDownloader Python RAT Dead-Drop-Resolver Beaconing & Malicious Archive Retrieval (KQL) · unlock with TL Creds
• 🔒 JDownloader Trojanized Installer Execution — Untrusted Publisher & Fraudulent Code Signature (Sigma) · unlock with TL Creds
• 🔒 JDownloader Campaign — WDAC/SIPolicy AV-Tampering, r77 Rootkit Injection & Linux SUID Persistence (Sigma) · unlock with TL Creds
• 🔒 JDownloader Python RAT Dead-Drop-Resolver Beaconing & Malicious Archive Retrieval (Sigma) · unlock with TL Creds
• 🔒 JDownloader Trojanized Installer Execution — Untrusted Publisher & Fraudulent Code Signature (SPL) · unlock with TL Creds
• 🔒 JDownloader Python RAT Dead-Drop-Resolver Beaconing & Malicious Archive Retrieval (SPL) · unlock with TL Creds

Indicators of compromise for JDownloader r77 installer hijack

As of 2026-07-06, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-1142.

Sample indicators (3 of 27)

• Domain: parkspringshotel[.]com
• Domain: auraguest[.]lk
• Domain: checkinnhotels[.]com

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration for JDownloader r77 installer hijack

4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How JDownloader r77 installer hijack works

Sophos Endpoint's Kernel32Trap exploit mitigation (targeting MITRE ATT&CK T1027.007, Dynamic API Resolution) blocked the trojanized Windows installer on 11 distinct customer endpoints between May 6 and May 8, 2026, ahead of the JDownloader team completing remediation.

Between approximately 23:55 UTC on May 5, 2026 and 00:01 UTC on May 6, 2026, unknown attackers conducted a dry run and then live exploitation of an unpatched, unauthenticated vulnerability in the content management system powering the official JDownloader download manager website (jdownloader.org). The flaw allowed the attackers to modify the site's access control lists and page content without any authentication, and they used this access to repoint the 'Download Alternative Installer' link (Windows) and the Linux shell installer link to attacker-controlled infrastructure. The underlying application server and the JDownloader software itself were not compromised; only the CMS-managed download page content was altered. No CVE identifier has been publicly assigned to this website-side flaw.

For approximately 41 hours (May 6-7, 2026), any visitor who used the affected links received a malicious build. The Windows package was an unsigned or fraudulently-signed wrapper (observed publisher names 'Zipline LLC' and 'The Water Team', in contrast to the legitimate publisher 'AppWork GmbH') that bundled the authentic JDownloader installer alongside a second, XOR-encrypted executable. That executable was decoded with the XOR key 'ectb' to reveal a Windows x64 loader, which in turn decrypted further embedded resources using the key 'fywo' to unpack a PyArmor-protected Python payload (reported as Python 3.14, PyArmor generation 8/9 depending on source). The resulting multi-component framework consisted of: (1) a modular Python bot/RAT capable of executing arbitrary Python code pushed from C2; (2) an r77 rootkit stager that first performs an AMSI bypass (an embedded .NET assembly drives a PowerShell cradle that patches AmsiScanBuffer in memory) and then injects 32-bit and 64-bit r77 hooking DLLs into winlogon.exe, hiding any process, file, or registry key whose name is prefixed '$77'; and (3) a malicious Windows Defender Application Control (WDAC) policy written to %WINDIR%\System32\CodeIntegrity\SIPolicy.p7b that deny-lists roughly 50 executable paths spanning six security vendors (Avast, AVG, Avira, Windows Defender, HitmanPro, Kaspersky Virus Removal Tool) plus core Windows security services -- after the next reboot, none of those tools can start. The dropper delays activation by roughly eight minutes to evade automated sandbox analysis, creates the mutex Global\0C3C1D37, and writes an RC4-encrypted, hex-encoded bot configuration to HKCU\SOFTWARE\Python containing a CampaignID and a DDRList of six dead-drop-resolver (DDR) URLs. The bot periodically fetches those DDR pages, RC4-decrypts the content to obtain live C2 addresses, and has been observed calling out to parkspringshotel.com/m/Lu6aeloo.php and auraguest.lk/m/douV2quu.php. Reported RAT capabilities include keystroke logging, screenshot capture, webcam/microphone capture, browser-stored credential harvesting, arbitrary Python code execution, additional payload retrieval, and C2-directed data exfiltration.

The Linux shell installer (JDownloader2Setup_unix_nojre.sh) had malicious shell code injected into it that downloads an archive disguised as an SVG image from checkinnhotels.com. The archive contains two ELF binaries, 'pkg' and 'systemd-exec'. The installer places 'systemd-exec' as a SUID-root binary in /usr/bin/, copies the main payload to /root/.local/share/.pkg, drops a persistence script at /etc/profile.d/systemd.sh, and executes the malware while masquerading as the legitimate desktop process /usr/libexec/upowerd.

Sophos reported that its Kernel32Trap exploit mitigation -- one of more than 60 proprietary, signature-less exploit mitigations enabled by default in Sophos Endpoint -- fired on 11 distinct customer endpoints between May 6 and May 8, 2026, blocking execution of the trojanized Windows installer in every case. Kernel32Trap targets MITRE ATT&CK T1027.007 (Dynamic API Resolution), the near-universal pattern of shellcode/loaders resolving Windows API functions at runtime instead of declaring them in the import table, and required no cloud lookup, signature, or prior knowledge of the campaign to block it.

The compromise was first surfaced publicly on May 7, 2026 at approximately 17:06 UTC when a Reddit user, 'PrinceOfNightSky', reported that an installer downloaded from the official JDownloader site triggered a Microsoft Defender alert. Eighteen minutes later (17:24 UTC), JDownloader developers confirmed the compromise and took the web server offline for investigation, closing the roughly 41-hour exposure window. The team subsequently patched the CMS access-control vulnerability and hardened server configuration, restoring the site on May 8-9, 2026 with verified clean installer links. In-app auto-updates, macOS downloads, the Flatpak/Winget/Snap packages, and the standalone JAR package were never affected. Users who ran the malicious installers during the compromise window are advised that antivirus removal cannot be relied upon given the rootkit and AV-tampering components, and should fully reinstall the operating system and rotate all credentials used on the affected host.

No threat actor has been publicly attributed to this campaign. Security researchers have noted a contemporaneous, technically distinct supply-chain compromise of DAEMON Tools installers in the same month (using valid, stolen/abused code-signing certificates over a longer ~27-day stealth window) but have not established a common actor or shared infrastructure between the two incidents; they are treated here as separate, unattributed campaigns that both targeted trust in popular utility-software distribution channels. The breadth of RAT capability (keylogging, webcam/mic capture, browser credential theft) is consistent with financially-motivated commodity crimeware distributed opportunistically to JDownloader's broad consumer user base, though this motivation assessment is inferred from tooling rather than confirmed by direct attribution evidence.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit; T1027.002 Software Packing; T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1497.003 Time Based Checks

Persistence

T1037.004 RC Scripts

Exfiltration

T1041 Exfiltration Over C2 Channel

Privilege Escalation

T1055.001 Dynamic-link Library Injection; T1548.001 Setuid and Setgid

Collection

T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

Execution

T1059.001 PowerShell; T1059.004 Unix Shell; T1059.006 Python; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

defense-impairment

T1112 Modify Registry; T1553.002 Code Signing; T1685 Disable or Modify Tools

Initial Access

T1195.002 Compromise Software Supply Chain

Credential Access

T1555.003 Credentials from Web Browsers

Lateral Movement

T1570 Lateral Tool Transfer

Resource Development

T1583.001 Domains; T1587.001 Malware; T1588.003 Code Signing Certificates; T1608.001 Upload Malware

Remediation for JDownloader r77 installer hijack

Patches

• AppWork GmbH (JDownloader operators) patched the underlying website CMS access-control vulnerability and hardened server configuration; no client-side JDownloader application patch was required
• No CVE identifier has been publicly assigned to the website CMS flaw as of this writing

Immediate actions

• Verify any JDownloader installer's digital signature is signed by the legitimate publisher AppWork GmbH before executing; treat installers signed by 'Zipline LLC', 'The Water Team', or unsigned as malicious
• Block outbound network access to parkspringshotel.com, auraguest.lk, and checkinnhotels.com at DNS/proxy/firewall layers
• Hunt Windows endpoints for the mutex Global\0C3C1D37, the registry key HKCU\SOFTWARE\Python, and the file %WINDIR%\System32\CodeIntegrity\SIPolicy.p7b
• Hunt Linux hosts that ran JDownloader2Setup_unix_nojre.sh between 2026-05-06 and 2026-05-07 for /root/.local/share/.pkg, /etc/profile.d/systemd.sh, and a SUID-root /usr/bin/systemd-exec binary masquerading as /usr/libexec/upowerd
• Treat any host that executed the trojanized installer during the compromise window as fully compromised: reimage/reinstall the OS rather than relying on AV removal (the rootkit and WDAC-based AV tampering can survive scans), and rotate all credentials used on that host

Workarounds

• Download JDownloader only via the in-app auto-updater, the standalone JAR package, or the official Flatpak/Winget/Snap packages, none of which were affected by the compromise
• Verify installer checksums/signatures against vendor-published values where available

Longer-term hardening

• Deploy EDR/exploit-mitigation technology capable of detecting dynamic API resolution (T1027.007) and unauthorized WDAC/SIPolicy.p7b deployment without relying solely on signatures
• Monitor and alert on unauthorized modifications to %WINDIR%\System32\CodeIntegrity\SIPolicy.p7b and unexpected AMSI provider/AmsiScanBuffer patching
• Establish code-signing and checksum verification pipelines for third-party open-source utilities before internal distribution
• Educate users to prefer signed in-app auto-update channels or official package managers over 'alternative installer' download links

Affected and fixed versions

• AppWork GmbH — JDownloader Windows Alternative Installer
  Vulnerable versions: Installer served via jdownloader.org 'Download Alternative Installer' link between 2026-05-06 and 2026-05-07
  Fixed in: Installer served after site remediation and restoration on 2026-05-08/2026-05-09
• AppWork GmbH — JDownloader Linux shell installer (JDownloader2Setup_unix_nojre.sh)
  Vulnerable versions: Shell installer served via jdownloader.org between 2026-05-06 and 2026-05-07
  Fixed in: Shell installer served after site remediation and restoration on 2026-05-08/2026-05-09

Timeline of JDownloader r77 installer hijack

• 2026-05-05 Attackers tested their CMS exploit against a low-traffic dummy page on locked-ioc-13 at approximately 23:55 UTC to validate the attack method before going live.
• 2026-05-06 Malicious installers began being served to visitors of the official JDownloader download page; the Windows payload delivered a PyArmor-obfuscated Python RAT plus locked-ioc-21 and AV-disabling WDAC policy, while the Linux payload installed a SUID-root ELF persistence mechanism.
• 2026-05-06 At approximately 00:01 UTC, six minutes after the dry run, attackers exploited the unauthenticated CMS access-control vulnerability to repoint the live Windows 'Alternative Installer' and Linux shell installer download links to attacker-controlled servers.
• 2026-05-07 Approximately 18 minutes after the Reddit report (17:24 UTC), JDownloader developers confirmed the site compromise and took the web server offline for investigation, closing a roughly 41-hour exposure window.
• 2026-05-07 Reddit user 'PrinceOfNightSky' reported at approximately 17:06 UTC that a JDownloader installer downloaded from the official site triggered a Microsoft Defender alert, first surfacing the compromise publicly.
• 2026-05-08 JDownloader developers (locked-ioc-20) patched the CMS access-control vulnerability and hardened the web server configuration.
• 2026-05-08 Sophos Endpoint's locked-ioc-19 exploit mitigation (targeting MITRE ATT&CK T1027.007, Dynamic API Resolution) blocked execution of the trojanized Windows installer on 11 distinct customer endpoints between May 6 and May 8, 2026, without any signature or cloud lookup.
• 2026-05-09 locked-ioc-13 was restored with verified clean installer links; users who had run the malicious installers during the compromise window were advised to fully reinstall their operating systems and rotate all credentials rather than rely on antivirus removal.

Sources cited for JDownloader r77 installer hijack

• Inside the JDownloader Supply-Chain Attack: An r77 Rootkit Bot That Kills Your Antivirus gendigital.com · Research
• JDownloader Website Supply Chain Attack: Installers Replaced with Python RAT Malware (May 2026) rescana.com · Research
• Malware analysis: jdownloader.org download page (ANY.RUN sandbox report) any.run · Research
• Sophos Endpoint in action: Blocking a novel supply chain attack Sophos · Blog
• Sophos stops AI-generated zero-day exploits Sophos · Blog
• Trust, Betrayed: The JDownloader & DAEMON Tools Supply Chain Attacks cyberleveling.com · Blog
• What JDownloader and Daemon Tools reveal about software distribution trust threatlocker.com · Blog
• JDownloader site hacked to replace installers with Python RAT malware BleepingComputer · News
• Official JDownloader site served malware to Windows and Linux users between May 6 and May 7 securityaffairs.com · News
• JDownloader website compromised to distribute malicious installers scworld.com · News
• JDownloader Hack Spreads New Python RAT gbhackers.com · News
• Top download manager JDownloader hacked — installers replaced with dangerous malware techradar.com · News
• JDownloader Downloader Hacked to Infect Users With New Python RAT cybersecuritynews.com · News
• Hackers Hijack JDownloader Site to Deliver Malware Through Installers hackread.com · News
• JDownloader Website Hacked to Spread Malware on Windows and Linux it-connect.tech · News

Threats related to JDownloader r77 installer hijack

• JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated Python RAT (May 6-7, 2026)

Previous and next in supply chain

• North Korea-Linked "Contagious Interview"/Famous Chollima Actors Hide JavaScript Loaders (PolinRider) in Open-Source Packages Previous report
• npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21 Exfiltrates Crypto Wallet Seed Phrases and Private Keys Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages