JHUHUGIT

Jhuhugit is a type of malware that was used in Sofacy attacks as a first-stage implant. It became relatively popular and was also used with a Java zero-day in July 2015. The Sofacy group, which utilized jhuhugit, expanded their arsenal in 2013 by adding more backdoors and tools, including CORESHELL, SPLM, and AZZY. In their attacks, the group spearphished targets in several waves using Flash exploits, leading to their carberp-based JHUHUGIT downloaders and further stages of malware. Jhuhugit was delivered through a Flash zero-day and used a Windows EoP exploit to break out of the sandbox. Recently, high-profile victims have been targeted with another first-level implant representing the latest evolution of Sofacy's AZZYTrojan. While jhuhugit and more recently, "JKEYSKW," are still being used in most of the Sofacy attacks, the group has continued to evolve and expand their arsenal over the years.