gigajew

gigajew is a likely cybercriminal persona associated with development of a multi-stage malware delivery chain culminating in AsyncRAT. The attribution is based on a developer artifact embedded in a .NET loader namespace, indicating linkage to the HackForums handle "gigajew." The observed intrusion chain used spearphishing lures themed around pricing requests and technical documentation, suggesting targeting of manufacturing, engineering, or procurement personnel. The operation employed a staged infection flow beginning with a double-extension script attachment, followed by hidden PowerShell execution via WMI, retrieval of a steganographically concealed .NET loader from legitimate cloud-hosted infrastructure, and in-memory loading of that loader. The loader, identified as Fiber, then fetched and executed a subsequent payload using CasPol.exe as a living-off-the-land binary. Fiber also established persistence through both scheduled-task creation and a Registry Run mechanism, and incorporated virtual-machine and sandbox detection logic for defense evasion. The final payload was an AsyncRAT variant configured for broad post-compromise surveillance and remote access. Supported functionality included keylogging, active-window tracking, screen capture, webcam or microphone access, reverse shell capability, AES-encrypted command-and-control, and plugin-based extensibility. These behaviors indicate capabilities spanning initial access, persistence, defense evasion, credential and information theft, and general post-exploitation. Available evidence supports characterization of gigajew as a financially motivated cybercriminal actor or malware developer rather than a nation-state operator.