# Adwind Java RAT targets enterprises via AnMaXX hosting

Published: 2017-08-28 · Severity: medium
Canonical: https://vorant.io/reports/2cdc323d-85ab-523c-b984-0bfb7ab7f1e9/adwind-java-rat-targets-enterprises-via-anmaxx-hosting

> Cross-platform Adwind RAT exploits widespread Java installations in corporate networks, with C&C infrastructure concentrated on AnMaXX-operated IP space across multiple hosting providers.

Adwind (also known as jRAT and JSocket) is a Java-based remote access trojan that poses a significant threat to enterprises due to Java's ubiquity in corporate environments. Written in Java, the malware operates across Windows, macOS, Linux, and Android platforms, making it exceptionally versatile. Oracle estimates Java is installed on over 3 billion devices globally, including ATMs, providing Adwind operators with an enormous potential victim base. The malware is primarily distributed through spam emails containing JAR files in ZIP archives or malicious download URLs.

Adwind has evolved into a malware-as-a-service offering since 2012, with notable campaigns reported by Trend Micro in early 2017 targeting multiple industries. Kaspersky research from 2016 documented JSocket.org selling Adwind on a subscription basis with technical support, obfuscation services, and VPN infrastructure for customers. The malware's success is partly attributed to poor antivirus detection rates and its ability to evade traditional security controls.

Recent analysis reveals dozens of Adwind botnet command-and-control servers hosted on infrastructure operated by AnMaXX, a company selling SEO hosting services under the IP NetworX brand. AnMaXX rents IP space across 17 prefixes from various hosting providers worldwide rather than operating its own autonomous system. Organizations should monitor network perimeter traffic to these identified IP ranges to detect potential Adwind infections, particularly on systems with Java installations.

## Mentioned in this report

- Malware: AdWind, JSocket, jRAT

## Detection guidance (public sample)

### Suspicious Java Process Launching JAR from User/Temp Directory

ATT&CK: T1204.002

Detects java.exe/javaw.exe executing a JAR file located in temp, downloads, or archive-extraction paths, consistent with Adwind RAT execution after spearphishing delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Java Process Launching JAR from User/Temp Directory
id: c2d1819d-8927-5fca-b364-748c251367f9
status: experimental
description: Detects java.exe or javaw.exe invoked with -jar pointing to a file in
  a temp, downloads, or appdata directory, a common pattern for Adwind/jRAT execution
  after a user opens a malicious JAR delivered via spearphishing attachment or link.
references:
- Adwind Java RAT AnMaXX hosting report
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \java.exe
    - \javaw.exe
  selection_cmd:
    CommandLine|contains: -jar
  selection_path:
    CommandLine|contains:
    - \AppData\Local\Temp\
    - \Downloads\
    - \AppData\Roaming\
    - \Temp\Rar$
    - \Temp\7z
  filter:
    CommandLine|contains:
    - \Program Files\Java\
    - \Program Files (x86)\Java\
  condition: selection_image and selection_cmd and selection_path and not filter
falsepositives:
- Legitimate Java applications distributed as portable JARs run from user download
  folders
- Software installers that stage JAR files in temp before execution
level: medium
tags:
- attack.t1204.002
- attack.t1566.001
- attack.execution
```

### Java Process Spawned from Email Client or Archive Utility

ATT&CK: T1566.001

Detects java.exe/javaw.exe being spawned directly by an email client, browser, or archive extraction tool, indicating a user opened a malicious JAR attachment or link consistent with Adwind delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawned from Email Client or Archive Utility
id: 5924ba3f-fbc1-5a4c-9103-1cc96e9c5769
status: experimental
description: Detects java.exe or javaw.exe launched as a child process of an email
  client, browser, or archive utility, matching the delivery pattern of Adwind RAT
  distributed as a JAR within a ZIP attachment or via a malicious download link.
references:
- Adwind Java RAT AnMaXX hosting report
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection_child:
    Image|endswith:
    - \java.exe
    - \javaw.exe
  selection_parent:
    ParentImage|endswith:
    - \outlook.exe
    - \thunderbird.exe
    - \winmail.exe
    - \chrome.exe
    - \firefox.exe
    - \msedge.exe
    - \winrar.exe
    - \7zFM.exe
    - \explorer.exe
  condition: selection_child and selection_parent
falsepositives:
- Users manually opening legitimate Java applications from browser downloads or email
  attachments
- IT staff testing Java utilities distributed via email
level: medium
tags:
- attack.t1566.001
- attack.t1566.002
- attack.t1204.002
```

### Java Process Making Outbound Network Connection to Uncommon Port

ATT&CK: T1071.001

Detects java.exe/javaw.exe establishing outbound network connections shortly after execution, consistent with Adwind RAT beaconing to its command-and-control infrastructure over standard web protocols. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Making Outbound Network Connection to Uncommon Port
id: 2e0e1530-1ef1-5b80-bf2f-a07bf6515c47
status: experimental
description: Detects java.exe or javaw.exe initiating outbound network connections,
  which is unusual for typical enterprise Java desktop applications and matches the
  C2 beaconing behavior of Adwind RAT to attacker-controlled hosting infrastructure.
references:
- Adwind Java RAT AnMaXX hosting report
author: Vorant
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    Initiated: 'true'
  filter_common_ports:
    DestinationPort:
    - 80
    - 443
  filter_local_java_apps:
    Image|contains:
    - \Program Files\Java\
    - \Program Files (x86)\Java\
  condition: selection and not filter_local_java_apps
falsepositives:
- Legitimate enterprise Java applications that communicate over the network (e.g.,
  licensing servers, update checkers)
- Java-based collaboration or business tools installed from Program Files
level: low
tags:
- attack.t1071.001
- attack.command_and_control
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://abuse.ch/blog/adwind-a-cross-plattform-rat

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2cdc323d-85ab-523c-b984-0bfb7ab7f1e9/adwind-java-rat-targets-enterprises-via-anmaxx-hosting.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup