MALWARE FAMILY

JADESNOW

Internal ID: js.jadesnow

aliases

Last seen:Mar 17, 2026

Intelligence Profile

JADESNOW is a JavaScript-based downloader malware family associated with the threat cluster UNC5342. JADESNOW utilizes EtherHiding to fetch, decrypt, and execute malicious payloads from smart contracts on the BNB Smart Chain and Ethereum. The input data stored in the smart contract may be Base64-encoded and XOR-encrypted. The final payload in the JADESNOW infection chain is usually a more persistent backdoor like INVISIBLEFERRET.JAVASCRIPT.

Threat Analysis

JADESNOW is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding

→https://crystalintelligence.com/investigations/how-we-proved-north-koreas-blockchain-malware-campaign/

→https://kuxhagra.com/posts/that-one-time-i-got-hacked/

→https://medium.com/@0xOZ/how-to-get-scammed-by-dprk-hackers-b2f7588aea76

→https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist-part-2/

→https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist-part-3/

→https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist-part-4/

→https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist/

→https://www.aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise

→https://www.aikido.dev/blog/react-native-aria-attack

Quick Facts

TypeMalware Family

Aliases1

Also Known As

js.jadesnow

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search JADESNOW