A DFIR investigation uncovered a modular Remote Access Trojan and proxy framework built on Deno, the JavaScript/TypeScript runtime. The attack chain began with a mailbombing campaign followed by Microsoft Teams vishing calls impersonating IT support, leading a victim to download and execute a malicious archive. The payload consisted of four obfuscated JavaScript modules: app.js (orchestrator), back.js (WebSocket C2 bridge via CloudFront), helper.js (local HTTP server executing cmd.exe commands on loopback port 10021), and webui.js (TCP proxy pivot on port 10022). Persistence was established via the HKCU Run registry key. Despite an active EDR, the implant and C2 channel were not initially detected. The post includes deobfuscated code, defender telemetry examples, KQL detection queries, IOCs, and a full MITRE ATT&CK mapping.
