Anatomy of a Deno-Based Proxy & RAT

What it is

An InfoGuard LABS DFIR breakdown of a real intrusion delivering a modular Deno-based RAT/proxy. Deno is a secure-by-default JavaScript/TypeScript runtime on V8. The implant is four obfuscated JS files rather than a compiled binary, chosen for cross-platform reach and lower detection.

How it works

The intrusion runs in stages: mailbombing three employees to create fatigue and a pretext, then a Microsoft Teams call from an external tenant impersonating internal IT support. The one employee who answered was directed to a fake self-service portal to download patch09913.b — a nonstandard extension that is actually an archive extractable with Windows tar. The user extracted it into AppData\Roaming\DenoJSEnv and ran the payload via:

conhost --headless C:\Users\user.name\AppData\Roaming\DenoJSEnv\deno.exe --allow-run C:\Users\user.name\AppData\Roaming\DenoJSEnv\app.js

The launcher (app.js) spawns three child Deno processes. Because Deno requires explicit permission flags (file, network, env, process), the author split functionality so each module runs with the minimum permission set — a microservice-like design using local loopback HTTP servers. The main backdoor connects to a CloudFront-hosted WebSocket C2, registers victim metadata, and brokers traffic; helper services provide arbitrary Windows command execution and generic TCP forwarding. All four files are obfuscated with string array shifting (array rotation).

Preconditions / Affected

Windows hosts where a user can be socially engineered into extracting and running an archive. Requires the Deno runtime dropped alongside the payload (self-contained in the archive). Delivery leans on external Teams accounts being able to call internal users.

What to do

• Alert on the TeamsImpersonationDetected operation in the Microsoft 365 Unified Audit Log, and correlate it with email telemetry — bursts of spam, password-reset, or subscription-confirmation mail near a Teams impersonation event is the pre-execution early warning. Microsoft Defender XDR can generate related Teams alerts if the relevant services are integrated.
• Monitor scripting runtimes (Deno/Node), unusual permission flags such as --allow-run, conhost --headless invocations, and local loopback listener services — not just payload binaries.
• Watch for the file/path IOCs: patch09913.b, extraction to AppData\Roaming\DenoJSEnv, and deno.exe running from that path.

Caveats

EDR was active but did not flag the implant or C2 channel; it alerted only on later LDAP queries and certificate-related recon. The authors note that a more careful attacker could keep the C2 undetected longer, so the recon-stage detection is not a reliable backstop. The fetched text cuts off mid-sentence in the obfuscation section, so per-module permission specifics and full IOC lists are not reproduced here.