H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[JSS Loader](https://attack.mitre.org/software/S0648) is Remote Access Trojan (RAT) with .NET and C++ variants that has been used by [FIN7](https://attack.mitre.org/groups/G0046) since at least 2020.(Citation: eSentire FIN7 July 2021)(Citation: CrowdStrike Carbon Spider August 2021)

Labels

malware

8 recorded

Relationships

uses

from FIN7

Group

uses

to Ingress Tool Transfer

Technique

uses

to JavaScript

Technique

uses

to Malicious File

Technique

uses

to PowerShell

Technique

uses

to Scheduled Task

Technique

uses

to Spearphishing Attachment

Technique

uses

to Visual Basic

Technique

3 external

References

mitre-attack

S0648

open

eSentire FIN7 July 2021

https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc

open

CrowdStrike Carbon Spider August 2021

https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/

open