Increase in jRAT Campaigns

Zscaler ThreatLabZ reports a surge in Java-based remote access Trojan (jRAT) infections delivered as malicious JAR attachments (e.g., "IRS UPDATES.jar", invoice/PO lures). The analysis describes a multi-layer packed sample that drops a VBS, checks for AV/firewalls, decrypts an embedded AES-encrypted jRAT (RSA-wrapped key), establishes C2 communication, persists via autostart registry entries, can download additional payloads, and can spy via the victim's camera; the report also provides filenames and a malicious URL observed during analysis.