JADESNOW
Aliases: ChainedDown
- First seen
- 2023-01-15 00:00:00
- Malware type
- downloader, backdoor
- Family
- Malware family
- Profile updated
- 2026-07-07 13:16:50
Targeted industries: technology-and-telecommunications financial-services government-and-public-sector
Context
JADESNOW is a JavaScript-based downloader malware family associated with the threat cluster UNC5342. JADESNOW utilizes EtherHiding to fetch, decrypt, and execute malicious payloads from smart contracts on the BNB Smart Chain and Ethereum. The input data stored in the smart contract may be Base64-encoded and XOR-encrypted. The final payload in the JADESNOW infection chain is usually a more persistent backdoor like INVISIBLEFERRET.JAVASCRIPT.
Reports & references
- cloud.google.com — Dprk Adopts Etherhiding (report)
- malpedia.caad.fkie.fraunhofer.de — Js.Jadesnow (report)
- kuxhagra.com — That One Time I Got Hacked (report)
- ransom-isac.org — Cross Chain Txdatahiding Crypto Heist (report)
- ransom-isac.org — Cross Chain Txdatahiding Crypto Heist Part 2 (report)
- crystalintelligence.com — How We Proved North Koreas Blockchain Malware Campaign (report)
- ransom-isac.org — Cross Chain Txdatahiding Crypto Heist Part 3 (report)
- ransom-isac.org — Cross Chain Txdatahiding Crypto Heist Part 4 (report)
- opensourcemalware.com — Polinrider Attack (report)
- esentire.com — North Korean Apt Malware Analysis Dev Popper Rat And Omnistealer Everyday Im Shufflin (report)
- aikido.dev — Catching A Rat Remote Access Trojian Rand User Agent Supply Chain Compromise (report)
- aikido.dev — React Native Aria Attack (report)
- medium.com — How To Get Scammed By Dprk Hackers B2F7588Aea76 (report)