Vjw0rm

Vjw0rm is a commodity Windows remote access trojan implemented in JavaScript and commonly executed through Windows Script Host. Active since at least 2016, it is associated with broad cybercriminal distribution rather than a single exclusive operator. The malware provides remote control and information-gathering capabilities on infected systems, including command execution, file and registry operations, environment reconnaissance, and security-product enumeration via WMI. Reported variants and campaigns have also supported self-propagation to USB and network locations.

Vjw0rm has been delivered through multiple social-engineering and malware-staging chains. Documented delivery methods include phishing campaigns, including judicial-notification lures and broader travel-, aviation-, and transportation-themed email operations, as well as cracked-software or keygen lures packaged in multi-stage archive-based droppers. In observed Windows infections, Vjw0rm has been launched through layered script execution involving PowerShell, JScript/VBScript hybrids, AutoHotkey-based orchestration, and dead-drop style retrieval from paste services.

Persistence mechanisms observed in Vjw0rm-related campaigns include startup-folder script placement, scheduled tasks, and Windows registry Run-key style persistence. The malware has been linked to campaigns attributed to TA2541, a financially motivated cybercriminal actor known for targeting aviation, aerospace, transportation, manufacturing, and defense organizations with commodity RATs. Vjw0rm has also appeared in broader commodity malware ecosystems used against other sectors through phishing and lure-based delivery. Its continued use reflects the durability of script-based RATs that combine low development cost, flexible staging chains, and effective post-compromise remote administration on Windows hosts.