JackalMalware
According to Kaspersky Labs, this malware tool set has been used by APT group GoldenJackal, which has been observed since 2019 and which usually targets government and diplomatic entities in the Middle East and South Asia with espionage. It consists of multiple components and is written in. NET.From MISP Galaxy
Last reported 27 days ago, by CERT-EU5 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1056.001Keylogging
“This means initial implants are relatively small and plugins are used to provide capabilities for clipboard monitoring, keylogging, file management, or interactive shell access.”
- T1195Supply Chain Compromise
“In regards to cybercrime, we noted a Rust crates supply-chain compromise via typosquatted dependency, with infrastructure overlapping with operations attributed to North Korea-linked threat actors.”
- T1505.003Web Shell
“Activity spanned over 100 countries and led to confirmed compromises, including administrative takeovers and web shell deployments, enabling follow-on access and potential credential theft.”
- T1684Social Engineering
“On the cyberespionage front, two Russia-linked APTs targeted EU countries with spearphishing and social engineering, and North Korea-linked threat actor Lazarus' continued its Operation Dream Job.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Cyber Brief 26-09 - August 2026“EU countries participated in Interpol-led Operation Jackal IV”
-
“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend“Interpol's Jackal IV disrupts West African crime infrastructure”
-
China's AI-Enabled APT Operations Are Getting Interesting“INTERPOL tackles West African organised crime: INTERPOL has announced that eight-month-long Operation Jackal IV has led to 58 arrests and the identification of 263 suspects.”
-
Interpol Operation Jackal IV Identifies 263 Cybercrime Suspects“Interpol Operation Jackal IV Identifies 263 Cybercrime Suspects”
-
Risky Bulletin: Russia starts blocking DoH and DoT“Operation Jackal IV: A global law enforcement led by Interpol has dismantled multiple West African criminal networks involved in cyber scams, BEC, and violent crimes.”
Indicators in its reports
named in the reports above- 9f1f11a708d393e0…06f18ffcc507in 1 report
- 2915b3f8b703eb744fc54c81f4a9c67fin 1 report
- w32.9f1f11a708-100.sbx[.]tgin 1 report
- 9896a6fcb9bb5ac1…66decd6a4a7fin 1 report
- 38de5b216c33833af710e88f7f64fc98in 1 report
- 38d053135ddceaef…eecec4ba8f55in 1 report
- 41444d7018601b599beac0c60ed1bf83in 1 report
- w32.38d053135d-95.sbx[.]tgin 1 report
- c4dd71e347a076ba…942ba2ab16b2in 1 report
- 9a47c4d379998ade2f8f99e23a630c06in 1 report
- w32.c4dd71e347-95.sbx[.]tgin 1 report
- a31f222fc283227f…e110308dbf91in 1 report
- 7bdbd180c081fa63ca94f9c22c457376in 1 report
- 95.sbx[.]tgin 1 report
- e7e784cae8d37f12…4f4e80933c47in 1 report
- a4480423617d0b0d3b38c8471cbf594cin 1 report
- xn--eck9c3e[.]zonein 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.