Connect with us

Hi, what are you looking for?


Malware & Threats

Kjw0rm Variant Used in French TV Station Attack: Researchers

The cyberattack conducted by pro-Islamic State hackers against the French TV station TV5Monde appears to have involved a piece of malware known as Kjw0rm, researchers at Blue Coat reported on Thursday.

The cyberattack conducted by pro-Islamic State hackers against the French TV station TV5Monde appears to have involved a piece of malware known as Kjw0rm, researchers at Blue Coat reported on Thursday.

The attackers managed to take control of the network’s systems and its social media operations. The ISIS-linked threat actors disrupted the station’s 11 channels and abused the company’s social media accounts to post threats and sensitive information, including the personal details of relatives of French soldiers involved in anti-IS operations.

There isn’t a lot of technical information on the attack, but French news website Breaking3zero has obtained some details. According to Breaking3zero, the attackers leveraged a Java vulnerability to deliver a malicious VBScript file that allowed them to take control of the infected devices.

Based on the information provided by Breaking3zero, Blue Coat researchers believe that the malware used by the pro-IS actors is a variant of Kjw0rm, one of the several remote access Trojans (RATs) developed using source code from the notorious Njw0rm (Jenxcus). Njw0rm and njRAT (Bladabindi), which are highly popular among Middle Eastern threat actors, were targeted in an operation initiated by Microsoft back in June 2014.

The Breaking3zero story revealed that the malware used in the TV5Monde attack was created by an individual using the online moniker “Najaf.” Blue Coat researchers say the code in the Najaf variant is similar to the code of regular Kjw0rm variants. “Most differences revolve around how hardcoded parameters are placed in the code,” Snorre Fagerland, senior principal security researcher at Blue Coat, said in a blog post.

Once it infects a device, the RAT collects information on the system and sends it back to the attackers. The attackers can then launch various commands to download files from a specified URL, execute files, execute shell commands, open websites, shutdown or restart the computer, and launch a ping flood attack against a specified target.

Attribution is a difficult matter. However, evidence uncovered by experts suggests that Najaf is an individual located in Iraq. It’s worth noting that Syria and Iraq are countries where Islamic State militants have occupied a lot of territory. A US-led military coalition that includes France has carried out airstrikes against the jihadist group in these regions.

TV5Monde boss Yves Bigot said the cyberattack, which he believes is “unprecedented in the history of television,” required weeks of preparation. Bigot has pointed out that his company has advanced IT security systems in place.

Advertisement. Scroll to continue reading.

However, as an interview given on Thursday by TV5Monde journalist David Delos shows, the TV station’s employees are not very conscientious when it comes to security. The interview was filmed in front of a board that contained several passwords. A Belgium-based ethical hacker has managed to read the password for TV5Monde’s YouTube channel off of it.

In an alert issued earlier this week, the FBI warned that individuals supporting ISIS have been defacing websites by exploiting WordPress vulnerabilities.

“The defacements have affected Web site operations and the communication platforms of news organizations, commercial entities, religious institutions, federal/state/local governments, foreign governments, and a variety of other domestic and international Web sites,” the FBI said. Although the defacements demonstrate low-level hacking sophistication, they are disruptive and often costly in terms of lost business revenue and expenditures on technical services to repair infected computer systems.”

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.


The recent ransomware attack targeting Rackspace was conducted by a cybercrime group named Play using a new exploitation method, the cloud company revealed this...

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.