JDownloader Supply-Chain Attack Delivered r77 Rootkit and Python Bot

May 21, 2026 · Original article ↗

Summary

A Gen Digital analysis details trojanized JDownloader installers delivered through compromised download links on May 6–7, 2026. The payload included an r77 rootkit, a Python bot and a WDAC policy that blocked security tools.

Key points

Attackers replaced selected links on the official JDownloader website with trojanized installers. Developers confirmed the compromise and restored clean downloads on May 9.
Affected downloads were fresh Windows alternative installers and the Linux shell installer during the compromise window; in-app updates, macOS downloads and package-manager installs were not affected.
The Windows payload combined a PyArmor-protected Python bot, an r77 rootkit stager and a WDAC policy that blocked 50 security-related executables after reboot.
The bot used encrypted dead-drop resolvers and DGA fallback domains to locate C2 servers; its RSA-OAEP and AES-GCM protocol supported arbitrary Python code execution.
The Linux chain used a SUID-root helper and a PyInstaller bundle, with persistence through /etc/profile.d/systemd.sh. The analysis found the Linux and Windows payloads shared core bot logic.
The researchers recommend treating systems as compromised if an affected installer was run; the article cites a clean OS reinstall as the safest remediation.

Article Details

Attack Vectors: Attackers compromised the official JDownloader website on May 6, 2026, and replaced selected download links with trojanized installers; fresh downloads through the affected links during May 6–7 were potentially compromised.
The Windows installer deployed a multi-stage payload including a PyArmor-protected Python bot, an r77 rootkit stager, and a WDAC policy that blocked security-related executables after reboot.
The Linux shell installer downloaded a disguised payload archive from checkinnhotels[.]com/img/logo1.svg. Its SUID helper launched the payload, which persisted through /etc/profile.d/systemd.sh.
The bot discovered C2 addresses through encrypted dead-drop resolver pages, with a DGA described as a fallback. C2 communications used RSA-OAEP and AES-GCM encryption.
The r77 component used reflective DLL injection into winlogon.exe, registry and service persistence, and hooks to hide processes, files, and registry keys.
Defensive Notes: Users who ran an affected installer, or cannot rule out having run it, should treat the system as compromised; the article recommends a clean operating system reinstall as the safest remediation.
Check for the WDAC policy at %WINDIR%System32CodeIntegritySIPolicy.p7b and the registry locations HKCUSOFTWAREPython and HKLMSOFTWARE$77stager. The article cautions that r77 may hide related artifacts from standard tools.
Use a trusted recovery environment or inspect registry hives offline if checking for hidden artifacts; do not rely on partial cleanup as sufficient remediation.
Until the system is rebuilt or inspected from a trusted recovery environment, avoid sensitive activity on it. Change important passwords from another trusted device and monitor accounts for unusual activity.
If an affected installer was downloaded but not run, delete it, obtain a fresh installer from the official JDownloader site, and run a full scan with up-to-date protection.
The article says in-app updates, macOS downloads, and package-manager installs through Flatpak, Winget, or Snap were not affected.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`auraguest[.]lk`	Compromised hotel reservation website used as an active C2 server.
DOMAIN	`checkinnhotels[.]com`	Compromised hotel reservation website used to host the Linux payload.
DOMAIN	`parkspringshotel[.]com`	Compromised hotel reservation website used as an active C2 server.
IPV4	`172[.]96[.]172[.]91`	IP address of the compromised host running the parkspringshotel[.]com C2 panel.
IPV4	`209[.]133[.]215[.]178`	IP address of the compromised host running the auraguest[.]lk C2 panel.
IPV4	`66[.]29[.]137[.]25`	IP address of the compromised host used to stage the Linux payload.
SHA256	`25744e90bfa44cbcbf1f3d3c3cb90dd79dd32a6e359df9d2660ff251d6d03b46`	SHA-256 hash of the Linux SUID helper systemd-exec.
SHA256	`33318499489cdb82543c0bfea699b98f5928c7a360966df6e958a9cbc2eab3fe`	SHA-256 hash of the PyArmor runtime DLL included in the malicious payload.
SHA256	`5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3`	SHA-256 hash of the analyzed Windows Stage 1 trojanized installer.
SHA256	`5c887054cb1dce077943afa955db43306f66795f7cbda8233d8ba25230a23d41`	SHA-256 hash of the r77 rootkit stager.
SHA256	`5ee86c177dc5bdba05e3bdc67b07115c66097f825fff257bf0d4a999bbb8a1ea`	SHA-256 hash of the malicious WDAC Code Integrity policy.
SHA256	`5fdbee7aa7ba6a5026855a35a9fe075967341017d3cb932e736a12dd00ed590a`	SHA-256 hash of the Windows PyArmor bot.
SHA256	`6550672cac21e036882921dd934ee06552dc74d3b0a9e1ddc26f952855e11371`	SHA-256 hash of the Linux payload archive distributed as logo1.svg.
SHA256	`6d975c05ef7a164707fa359284a31bfe0b1681fe0319819cb9e2c4eec2a1a8af`	SHA-256 hash of the Linux shell installer.
SHA256	`77a60b5c443f011dc67ace877f5b2ad7773501f3d82481db7f4a5238cf895f80`	SHA-256 hash of the Stage 2 C++ dropper.
SHA256	`bf47585bd0b39f0731f044b37a95eb7e311ad31b23b50306a113a3aa777dbfab`	SHA-256 hash of the Linux PyInstaller bot package.