Jaku Botnet

Posted: May 5, 2016
Threat Metric
Threat Level: 8/10
Infected PCs 7

Jaku Botnet Description

The Jaku Botnet is a network of Trojans using compromised PCs for conducting a variety of illicit activities. Although many of these Trojans' attacks may target other machines besides the infected host, a Jaku Botnet Trojan also may install other threats, and has been correlated with illegitimate reconnaissance activities. Malware researchers recommend that all concerned parties monitor their file downloads for potential Jaku Botnet droppers, and remove a Jaku Botnet Trojan with anti-malware products as needed.

Asia in the Grasp of a Trojan's Networked Tentacles

The Jaku Botnet has been under active deployment since fall of 2015. Although hundreds of countries are on this campaign's list of compromised regions, which does not take overly strict steps to limit its infection of new platforms, entities within Japan and South Korea are a clear majority of victims. Various government branches, corporations, and other NGO institutions all have been impacted through the Jaku Botnet's most widely-used infection vector, seeded torrent downloads. There also is a strong correlation between the usage of unlicensed versions of the Windows operating system with the presence of a Jaku Botnet Trojan.

Although the Jaku Botnet has experienced significant growth in its half-year lifespan, its developers (potentially affiliated with the previously-known Lazarus threat actor) have taken various steps for protecting their Trojans from detection. The Jaku Botnet's Trojans incorporate multiple, backup server communication mechanisms, infection monitoring via an obfuscated version of the SQLite library, and a variety of open source code solutions.

For now, malware analysts emphasize the following features as particularly important security risks for any system compromised by the Jaku Botnet:

  • A Jaku Botnet Trojan can exploit the resources of infected machines to accomplish common botnet-based attacks, including sending spam or crashing websites via Denial-of-Service floods.
  • Along with their personal features, the Jaku Botnet Trojans may supplement their payloads with the capabilities of other threats that they can install arbitrarily. Such functions are most likely of being used to collect information from high-value targets, such as engineering or pharmaceutical administrators.

The Jaku Botnet also has joined the relatively limited number of threatening programs using the art of steganography, or concealing secret information within 'harmless' content like images, for hiding itself. Previously, malware experts associated such exploits with equally high-level threats, such as the backdoor Trojan HAMMERTOSS.

Pulling Your Part of the Plug on the Jaku Botnet

The Jaku Botnet is, by design, meant to siphon the compromised system's resources for harmful acts while showing no symptoms for giving its presence away to any users. However, attentive PC owners may note persistent changes in memory usage, or automated attempts to contact compromised IP addresses, of which the security company of Forcepoint has provided a partial list. Because of this threat's focus on torrent-based distribution methods, avoiding peer-to-peer downloads through applications like BitTorrent can limit its distribution.

The Jaku Botnet's developers are most likely of Korean origin and show a particular interest in compromising valuable targets within that region, but PCs in other nations also are confirmed targets. Doing your part to prevent the flood of spam, DDoS attacks and other, decentralized harmful campaigns requires halting the distribution of responsible threats like the Jaku Botnet Trojans. If you suspect that your PC has become part of the Jaku Botnet, use your automated anti-malware tools for removing the Trojan, and any secondary threat that the Jaku Botnet may install.

However, based on the Trojan's preference for users executing pirated Windows versions, PC users having second thoughts about their preferred methods of acquiring operating systems also may be just as critical a factor in this threat campaign.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Jaku Botnet may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.