JSSLoader

Internal ID: win.jssloader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying win.jssloader. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

JSSLoader is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.morphisec.com/new-jssloader-trojan-delivered-through-xll-files

→https://blog.morphisec.com/vmware-identity-manager-attack-backdoor

→https://malwarebytes.app.box.com/s/ym6r7o5hq0rx2nxjbctfv2sw5vx386ni

→https://www.bleepingcomputer.com/news/security/malicious-microsoft-excel-add-ins-used-to-deliver-rat-malware/

→https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/

→https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/

→https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition

→https://www.mandiant.com/resources/evolution-of-fin7

→https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/

→https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.jssloader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search JSSLoader