APT / THREAT GROUP

jRAT

Internal ID: jar.jrat

aliases

Last seen:Mar 17, 2026

Intelligence Profile

jRAT, also known as Jacksbot, is a RAT with history, written in Java. It has support for macOS, Linux, Windows and various BSD. It also has functionality to participate in DDoS-attacks as well as to perform click fraud. Note that the Adwind family often is mistakenly labeled as jRAT, because of of a red hering reference to jrat.io.

Threat Analysis

jRAT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.trendmicro.com/trendlabs-security-intelligence/jacksbot-has-some-dirty-tricks-up-its-sleeves/

→https://maskop9.wordpress.com/2019/02/06/analysis-of-jacksbot-backdoor/

→https://research.checkpoint.com/malware-against-the-c-monoculture/

→https://www.eff.org/files/2018/01/29/operation-manul.pdf

→https://www.intego.com/mac-security-blog/new-multiplatform-backdoor-jacksbot-discovered

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

jar.jrat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search jRAT