Deno-Based Malware Abuses CloudFront WebSocket C2 for Remote Access and Internal Pivoting

Threat actors are increasingly abandoning traditional compiled malware in favor of legitimate scripting engines to evade detection.

In a sophisticated recent intrusion, attackers deployed a modular Remote Access Trojan (RAT) using Deno, a secure JavaScript and TypeScript runtime.

By combining aggressive social engineering with a fragmented, microservice-like architecture, the attackers successfully bypassed initial endpoint security.

They established a covert command-and-control (C2) channel over a CloudFront-hosted WebSocket. The intrusion stands out because it bypassed active Endpoint Detection and Response (EDR) systems during its initial execution.

Alerts were only triggered later during subsequent reconnaissance activities, such as internal directory queries.

This highlights a critical blind spot: defenders must monitor not just payload binaries, but also scripting runtimes, local loopback services, and the abuse of legitimate collaboration platforms.

Deno Malware Enables Pivoting

The attack began with a high-volume email flooding campaign, commonly known as mailbombing, targeting specific employees. Over the course of a single day, victims received hundreds of spam emails.

This tactic served a dual purpose: it created deep user fatigue. It established a highly plausible pretext for fake IT support to intervene.

Shortly after the email flood began, the targeted employees received Microsoft Teams calls from an external account impersonating the internal help desk.

The attacker used internal company context and employee names, likely scraped from public sources, to build trust.

When one employee answered, the attacker claimed they were responding to the ongoing email issue and directed the victim to a fake self-service support portal.

The user was instructed to download a disguised archive file named patch09913.b. Following the attacker’s guidance, the victim extracted this archive into their local application data folder.

The primary payload was then executed using a headless console process, quietly launching the Deno environment in the background to avoid alerting the user.

Deno is designed to be secure by default, requiring explicit permission flags to access sensitive resources such as the file system or the network.

To work around this, the malware author designed a microservice-style architecture, splitting the RAT’s functionality across four highly obfuscated JavaScript files.

By hiding readable text using a technique called string array shifting, the malware easily defeated basic static analysis tools that rely on readable URLs or command-line arguments, infoguard said.

Because the malware relied on local loopback connections to pass instructions between these isolated modules, the external-facing C2 process appeared much less suspicious.

To defend against this modern threat, organizations must adopt behavioral detection strategies.

Security teams should alert on Deno executions originating from user-writable directories, on unusual permission flags such as –allow-run or –allow-net, and on uncommon runtimes binding to loopback interfaces.

By correlating these endpoint indicators with collaboration platform anomalies, defenders can stop these fragmented attacks before internal lateral movement occurs.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.