jerrymac2008

jerrymac2008 is a financially motivated cybercriminal operator associated with commodity malware operations centered on XWorm and also linked to Remcos, NjRAT, LucaStealer, and cryptocurrency mining activity. The actor has used phishing lures in both Spanish and English, with evidence indicating targeting of Spanish-speaking victims. Operational tradecraft includes multi-stage malware delivery, use of decentralized IPFS-hosted payloads to complicate takedown and infrastructure disruption, and resilient command-and-control supported by dynamic DNS and rotating infrastructure. Observed intrusion chains use malicious script-based initial access, followed by hidden PowerShell execution launched through WMI, retrieval of steganographically concealed payloads, in-memory loading of .NET components, and process injection into legitimate Windows binaries for execution of the final remote-access payload. Persistence has included Startup-folder placement, scheduled tasks, and registry Run-key mechanisms. The actor’s malware delivery and execution flow demonstrates defense evasion through heavy script padding and obfuscation, steganographic payload concealment, memory-only loading, and abuse of legitimate system utilities. Post-compromise behavior includes command-and-control communications and data exfiltration capabilities consistent with XWorm and related commodity RAT operations. The actor appears to run a broad criminal service model rather than a single-tool campaign, operating multiple malware families from overlapping infrastructure. No high-confidence evidence directly attributes this actor to a nation-state sponsor.