# JDownloader Website Supply-Chain Compromise Distributes Trojanized Installers (Python RAT / Linux Persistence Malware)

> Attackers exploited an unauthenticated CMS flaw on jdownloader.org between May 6-7, 2026 to swap the Windows 'Alternative Installer' and Linux shell installer download links with trojanized binaries. The Windows payload bundled the legitimate installer with a PyArmor-obfuscated Python RAT, an r77 rootkit with an AMSI bypass, and a malicious Windows Defender Application Control (WDAC) policy that disabled 50 security-vendor executables including Microsoft Defender; the Linux payload installed a SUID-root ELF binary masquerading as a system process. Sophos Endpoint's Kernel32Trap exploit mitigation (targeting MITRE ATT&CK T1027.007, Dynamic API Resolution) blocked the trojanized Windows installer on 11 distinct customer endpoints between May 6 and May 8, 2026, ahead of the JDownloader team completing remediation.

- **Published:** 2026-07-06T00:00:00Z
- **Last reviewed:** 2026-07-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1142
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-jdownloader-r77-installer-hijack-tl-2026-1142.webp?v=edc6e0c5 (Threadlinqs threat intel: JDownloader Link Swap Ships r77 Rootkit: Detection & IOCs (TL-2026-1142) — High severity, 27 IOCs, 9 detection rules.)
- **ID:** TL-2026-1142
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

Between approximately 23:55 UTC on May 5, 2026 and 00:01 UTC on May 6, 2026, unknown attackers conducted a dry run and then live exploitation of an unpatched, unauthenticated vulnerability in the content management system powering the official JDownloader download manager website (jdownloader.org). The flaw allowed the attackers to modify the site's access control lists and page content without any authentication, and they used this access to repoint the 'Download Alternative Installer' link (Windows) and the Linux shell installer link to attacker-controlled infrastructure. The underlying application server and the JDownloader software itself were not compromised; only the CMS-managed download page content was altered. No CVE identifier has been publicly assigned to this website-side flaw.

For approximately 41 hours (May 6-7, 2026), any visitor who used the affected links received a malicious build. The Windows package was an unsigned or fraudulently-signed wrapper (observed publisher names 'Zipline LLC' and 'The Water Team', in contrast to the legitimate publisher 'AppWork GmbH') that bundled the authentic JDownloader installer alongside a second, XOR-encrypted executable. That executable was decoded with the XOR key 'ectb' to reveal a Windows x64 loader, which in turn decrypted further embedded resources using the key 'fywo' to unpack a PyArmor-protected Python payload (reported as Python 3.14, PyArmor generation 8/9 depending on source). The resulting multi-component framework consisted of: (1) a modular Python bot/RAT capable of executing arbitrary Python code pushed from C2; (2) an r77 rootkit stager that first performs an AMSI bypass (an embedded .NET assembly drives a PowerShell cradle that patches AmsiScanBuffer in memory) and then injects 32-bit and 64-bit r77 hooking DLLs into winlogon.exe, hiding any process, file, or registry key whose name is prefixed '$77'; and (3) a malicious Windows Defender Application Control (WDAC) policy written to %WINDIR%\System32\CodeIntegrity\SIPolicy.p7b that deny-lists roughly 50 executable paths spanning six security vendors (Avast, AVG, Avira, Windows Defender, HitmanPro, Kaspersky Virus Removal Tool) plus core Windows security services -- after the next reboot, none of those tools can start. The dropper delays activation by roughly eight minutes to evade automated sandbox analysis, creates the mutex Global\0C3C1D37, and writes an RC4-encrypted, hex-encoded bot configuration to HKCU\SOFTWARE\Python containing a CampaignID and a DDRList of six dead-drop-resolver (DDR) URLs. The bot periodically fetches those DDR pages, RC4-decrypts the content to obtain live C2 addresses, and has been observed calling out to parkspringshotel.com/m/Lu6aeloo.php and auraguest.lk/m/douV2quu.php. Reported RAT capabilities include keystroke logging, screenshot capture, webcam/microphone capture, browser-stored credential harvesting, arbitrary Python code execution, additional payload retrieval, and C2-directed data exfiltration.

The Linux shell installer (JDownloader2Setup_unix_nojre.sh) had malicious shell code injected into it that downloads an archive disguised as an SVG image from checkinnhotels.com. The archive contains two ELF binaries, 'pkg' and 'systemd-exec'. The installer places 'systemd-exec' as a SUID-root binary in /usr/bin/, copies the main payload to /root/.local/share/.pkg, drops a persistence script at /etc/profile.d/systemd.sh, and executes the malware while masquerading as the legitimate desktop process /usr/libexec/upowerd.

Sophos reported that its Kernel32Trap exploit mitigation -- one of more than 60 proprietary, signature-less exploit mitigations enabled by default in Sophos Endpoint -- fired on 11 distinct customer endpoints between May 6 and May 8, 2026, blocking execution of the trojanized Windows installer in every case. Kernel32Trap targets MITRE ATT&CK T1027.007 (Dynamic API Resolution), the near-universal pattern of shellcode/loaders resolving Windows API functions at runtime instead of declaring them in the import table, and required no cloud lookup, signature, or prior knowledge of the campaign to block it.

The compromise was first surfaced publicly on May 7, 2026 at approximately 17:06 UTC when a Reddit user, 'PrinceOfNightSky', reported that an installer downloaded from the official JDownloader site triggered a Microsoft Defender alert. Eighteen minutes later (17:24 UTC), JDownloader developers confirmed the compromise and took the web server offline for investigation, closing the roughly 41-hour exposure window. The team subsequently patched the CMS access-control vulnerability and hardened server configuration, restoring the site on May 8-9, 2026 with verified clean installer links. In-app auto-updates, macOS downloads, the Flatpak/Winget/Snap packages, and the standalone JAR package were never affected. Users who ran the malicious installers during the compromise window are advised that antivirus removal cannot be relied upon given the rootkit and AV-tampering components, and should fully reinstall the operating system and rotate all credentials used on the affected host.

No threat actor has been publicly attributed to this campaign. Security researchers have noted a contemporaneous, technically distinct supply-chain compromise of DAEMON Tools installers in the same month (using valid, stolen/abused code-signing certificates over a longer ~27-day stealth window) but have not established a common actor or shared infrastructure between the two incidents; they are treated here as separate, unattributed campaigns that both targeted trust in popular utility-software distribution channels. The breadth of RAT capability (keylogging, webcam/mic capture, browser credential theft) is consistent with financially-motivated commodity crimeware distributed opportunistically to JDownloader's broad consumer user base, though this motivation assessment is inferred from tooling rather than confirmed by direct attribution evidence.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1583.001 Domains
- T1587.001 Malware
- T1588.003 Code Signing Certificates
- T1608.001 Upload Malware
- T1204.002 Malicious File
- T1059.006 Python
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1037.004 RC Scripts
- T1548.001 Setuid and Setgid
- T1055.001 Dynamic-link Library Injection
- T1027.007 Dynamic API Resolution
- T1027.002 Software Packing
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1553.002 Code Signing
- T1036.005 Match Legitimate Resource Name or Location
- T1497.003 Time Based Checks
- T1112 Modify Registry
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1570 Lateral Tool Transfer
- T1056.001 Keylogging
- T1113 Screen Capture
- T1125 Video Capture
- T1123 Audio Capture
- T1041 Exfiltration Over C2 Channel
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**JDownloader Campaign — WDAC/SIPolicy AV-Tampering, r77 Rootkit Injection & Linux SUID Persistence (SPL)** (`TL-2026-1142-SPL-002`)

Detects the post-exploitation persistence/privilege-escalation/defense-evasion stage: malicious WDAC SIPolicy.p7b deployment that disables security vendors, RC4/hex-encoded bot configuration written to HKCU\SOFTWARE\Python, r77 rootkit DLL injection into winlogon.exe, and the Linux SUID-root systemd-exec binary plus /etc/profile.d persistence script masquerading as /usr/libexec/upowerd.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1685, T1112, T1055.001, T1014, T1548.001, T1037.004, T1036.005
- **Data sources:** sysmon, windows_security, linux_audit, edr_file_events, edr_registry_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
( (EventCode=11 TargetFilename="*\\System32\\CodeIntegrity\\SIPolicy.p7b")
  OR (EventCode=13 TargetObject="*\\SOFTWARE\\Python\\*" Details!="")
  OR (EventCode=8 TargetImage="*\\winlogon.exe") )
| eval technique=case(EventCode=11, "T1685 WDAC/AV Tamper", EventCode=13, "T1112 Registry Bot Config", EventCode=8, "T1055.001 DLL Injection - winlogon.exe")
| where NOT (EventCode=11 AND (Image="*\\TrustedInstaller.exe" OR Image="*\\ConfigCI.dll" OR Image="*\\dism.exe"))
| table _time, ComputerName, EventCode, technique, Image, SourceImage, TargetImage, TargetFilename, TargetObject, Details
| append
    [ search index=linux_audit sourcetype=auditd
        ( (path="/usr/bin/systemd-exec" (perm="*s*" OR mode="*4755*"))
          OR (path="/etc/profile.d/systemd.sh")
          OR (comm="upowerd" NOT exe="/usr/lib/upower/upowerd" NOT exe="/usr/libexec/upowerd") )
      | table _time, host, path, perm, mode, comm, exe ]
| sort - _time
```

### Microsoft KQL

```kql
let WinSIPolicy =
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has @"System32\CodeIntegrity\SIPolicy.p7b"
    | where InitiatingProcessFileName !in~ ("TrustedInstaller.exe","ConfigCI.exe","dism.exe")
    | project Timestamp, DeviceName, ActionType, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, Technique = "T1562.001";
let WinRegistry =
    DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey has @"SOFTWARE\Python" and RegistryValueData matches regex @"^[0-9A-Fa-f]{40,}$"
    | project Timestamp, DeviceName, ActionType, FolderPath = RegistryKey, InitiatingProcessFileName, InitiatingProcessCommandLine = RegistryValueData, InitiatingProcessAccountName, Technique = "T1112";
let LinuxPersist =
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath in ("/usr/bin/systemd-exec","/etc/profile.d/systemd.sh")
    | project Timestamp, DeviceName, ActionType, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, Technique = "T1548.001/T1037.004";
WinSIPolicy
| union WinRegistry
| union LinuxPersist
| sort by Timestamp desc
```

### Sigma

```yaml
title: Unauthorized SUID-Root Binary "systemd-exec" Created Outside Package Manager
id: 7a2d4f10-9c33-4e6b-8f21-a1b2c3d4e002
status: experimental
description: Detects creation of a SUID-root binary named systemd-exec in /usr/bin, matching the persistence mechanism dropped by the trojanized JDownloader Linux shell installer, along with its companion /etc/profile.d login-persistence script and process masquerading as /usr/libexec/upowerd.
references:
    - https://www.gendigital.com/blog/insights/research/inside-the-jdownloader-supply-chain-attack
    - TL-2026-1142
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-06
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.defense-evasion
    - attack.t1548.001
    - attack.t1037.004
    - attack.t1036.005
logsource:
    category: file_event
    product: linux
detection:
    selection_suid_binary:
        file_path|startswith: '/usr/bin/'
        file_name: 'systemd-exec'
    selection_persist_script:
        file_path: '/etc/profile.d/systemd.sh'
    condition: selection_suid_binary or selection_persist_script
falsepositives:
    - Legitimate systemd-related tooling coincidentally named systemd-exec installed via a trusted package manager (verify package provenance with dpkg -S / rpm -qf)
level: high
```

**Known false positives:**

- Legitimate WDAC policy deployments pushed by TrustedInstaller.exe, ConfigCI.exe, dism.exe, or an authorized MDM/Intune WDAC management workflow
- Third-party Python interpreters or dev tooling that legitimately write configuration values under HKCU\SOFTWARE\Python (verify the value is not RC4/XOR-obfuscated bot config format)
- Custom-built systemd-adjacent tooling named systemd-exec installed and tracked by the organization's package manager

**Tuning notes:** Baseline the organization's legitimate WDAC policy update process (owner/service accounts, change-ticket references) and exclude those initiating processes; tune the registry selector's hex-length/entropy threshold to reduce noise from legitimate long configuration blobs; verify every Linux SUID hit against package-manager provenance (dpkg -S / rpm -qf) before escalating.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- JDownloader Trojanized Installer Execution — Untrusted Publisher & Fraudulent Code Signature (KQL) (locked: unlock with TL Creds)
- JDownloader Campaign — WDAC/SIPolicy AV-Tampering, r77 Rootkit Injection & Linux SUID Persistence (KQL) (locked: unlock with TL Creds)
- JDownloader Python RAT Dead-Drop-Resolver Beaconing & Malicious Archive Retrieval (KQL) (locked: unlock with TL Creds)
- JDownloader Trojanized Installer Execution — Untrusted Publisher & Fraudulent Code Signature (Sigma) (locked: unlock with TL Creds)
- JDownloader Campaign — WDAC/SIPolicy AV-Tampering, r77 Rootkit Injection & Linux SUID Persistence (Sigma) (locked: unlock with TL Creds)
- JDownloader Python RAT Dead-Drop-Resolver Beaconing & Malicious Archive Retrieval (Sigma) (locked: unlock with TL Creds)
- JDownloader Trojanized Installer Execution — Untrusted Publisher & Fraudulent Code Signature (SPL) (locked: unlock with TL Creds)
- JDownloader Python RAT Dead-Drop-Resolver Beaconing & Malicious Archive Retrieval (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- Domain: `parkspringshotel[.]com`
- Domain: `auraguest[.]lk`
- Domain: `checkinnhotels[.]com`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Sophos Endpoint in action: Blocking a novel supply chain attack](https://www.sophos.com/en-us/blog/sophos-supply-chain-attack)
- [Sophos stops AI-generated zero-day exploits](https://www.sophos.com/en-us/blog/ai-zero-days-sophos-endpoint)
- [JDownloader site hacked to replace installers with Python RAT malware](https://www.bleepingcomputer.com/news/security/jdownloader-site-hacked-to-replace-installers-with-python-rat-malware/)
- [Official JDownloader site served malware to Windows and Linux users between May 6 and May 7](https://securityaffairs.com/191920/malware/official-jdownloader-site-served-malware-to-windows-and-linux-users.html)
- [Inside the JDownloader Supply-Chain Attack: An r77 Rootkit Bot That Kills Your Antivirus](https://www.gendigital.com/blog/insights/research/inside-the-jdownloader-supply-chain-attack)
- [JDownloader website compromised to distribute malicious installers](https://www.scworld.com/brief/jdownloader-website-compromised-to-distribute-malicious-installers)
- [JDownloader Website Supply Chain Attack: Installers Replaced with Python RAT Malware (May 2026)](https://www.rescana.com/post/jdownloader-website-supply-chain-attack-installers-replaced-with-python-rat-malware-may-2026/)
- [Trust, Betrayed: The JDownloader & DAEMON Tools Supply Chain Attacks](https://cyberleveling.com/blog/trust-betrayed-jdownloader-daemon-tools-supply-chain-2026)
- [JDownloader Hack Spreads New Python RAT](https://gbhackers.com/jdownloader-hack/)
- [Top download manager JDownloader hacked — installers replaced with dangerous malware](https://www.techradar.com/pro/security/top-download-manager-jdownloader-hacked-installers-replaced-with-dangerous-malware)
- [JDownloader Downloader Hacked to Infect Users With New Python RAT](https://cybersecuritynews.com/jdownloader-downloader-hacked/)
- [What JDownloader and Daemon Tools reveal about software distribution trust](https://www.threatlocker.com/blog/what-jdownloader-and-daemon-tools-reveal-about-software-distribution-trust)
- [Hackers Hijack JDownloader Site to Deliver Malware Through Installers](https://hackread.com/hackers-hijack-jdownloader-site-malware-installers/)
- [JDownloader Website Hacked to Spread Malware on Windows and Linux](https://www.it-connect.tech/official-jdownloader-site-compromised-to-distribute-malware-on-windows-and-linux/)
- [Malware analysis: jdownloader.org download page (ANY.RUN sandbox report)](https://any.run/report/e145151c7c677add958308e0223cacfdf92f68edf00a94716e221c0fc6b3b3d3/9415e9c9-aa75-429e-bb7e-e4db2df37b67)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1142