JAKU

Forcepoint's JAKU analysis describes a sophisticated, large-scale botnet campaign that combined poisoned BitTorrent distribution and multi-stage malware (including fake PNG second stages and custom RC4/LZH routines) to infect roughly 19k unique victims while simultaneously running a small, targeted espionage operation against individuals linked to North Korea; the report provides deep technical breakdowns of binaries, stealth persistence (process injection, Active Setup), multi-protocol C2 mechanisms (HTTP, DNS, UDT/TCP), SQLite-based telemetry, victim geography/demographics, C2 infrastructure and numerous IoCs.