Beware! Jackal Malware Becomes a Master at Manipulation

A notorious Advanced Persistent Threat (APT) group named GoldenJackal has recently developed a potent collection of .NET malware tools known as Jackal. This malicious toolset, comprising various components like JackalControl, JackalWorm, JackalSteal, JackalPerInfo, and JackalScreenWatcher, has been specifically tailored to target government and diplomatic entities in the Middle East and South Asia regions. By delving into the functionalities of each component, we can gain a deeper understanding of the threat posed by the Jackal malware.

Remote Manipulation at the Fingertips

At the heart of the Jackal toolset lies JackalControl, a Trojan designed to grant threat actors remote control over compromised machines. With a predefined set of supported commands, cybercriminals can exercise complete control over targeted systems. This insidious software empowers attackers to execute any desired program with specific arguments, retrieve chosen files, save them locally, and upload selected files onto the compromised machine. The presence of JackalControl opens the door for disruptive activities, compromises privacy, and facilitates the deployment of additional malware.

Stealthy Extraction of Valuable Data

JackalSteal, selectively deployed on compromised machines, specializes in locating specific files of interest within the target's system and extracting them to a command-and-control (C2) server. This versatile tool can monitor removable USB drives, remote shares, and all logical drives present in the targeted system, enabling cybercriminals to gather and exfiltrate desired data. By utilizing JackalSteal, threat actors can obtain sensitive information from compromised systems, potentially leading to severe consequences such as data breaches and theft of valuable insights.

Jackal Malware May Propagate through Removable USB Drives

The JackalWorm component of the Jackal malware serves as a carefully crafted tool for propagating and infecting systems via removable USB drives. This adaptable malware enables cybercriminals to introduce various types of malware into targeted systems. By actively monitoring removable USB drives, JackalWorm may identify devices allowing it to copy and spread via detected storage media. This method of propagation presents a significant threat, as it can quickly lead to widespread infections within an organization's network.

JackalPerInfo is a tool specifically designed to gather information from compromised systems. It targets a set of files that may contain credentials or details about web activities. By collecting sensitive data, this component enables threat actors to gain unauthorized access, compromise credentials, or extract valuable insights into the victim's online behavior. JackalPerInfo operates as an info-stealer malware, extracting files from specific directories like Desktop, Documents, Downloads, and AppData\Roaming\Microsoft\Windows\Recent. The stolen information is then transmitted to unauthorized recipients, escalating the potential damage caused by the malware.

JackalScreenWatcher: Unauthorized Surveillance

Employed by the Jackal malware, JackalScreenWatcher serves the purpose of capturing screenshots of the victim's desktop and transmitting them to a remote command-and-control (C2) server. This functionality enables unauthorized surveillance and the acquisition of visual data from the victim's computer. Victims of Jackal malware can face severe consequences, such as theft of their personal data. Furthermore, the malware's capabilities, such as file exfiltration, remote control, and surveillance, can disrupt operations, compromise privacy, and expose victims to further cyber threats.

Jackal Malware Removal Threats like Jackal malware may not make themselves well known on an infected Windows computer. Most computer users may not know of its presence, which then allows it to perform various malicious activities without their knowledge or consent. Removing such a threat is recommended by computer security experts to be done automatically using a reputable anti-malware program so that any traces or files associated with Jackal Malware may be safely eliminated.