JAVS Viewer installer delivered backdoor

JAVS Viewer is used in courtroom and hearing-room recording environments. Rapid7 traced an incident back to JAVS Viewer Setup 8.3.7.250-1.exe, downloaded from the official JAVS site on March 5, 2024.

The installer was signed, but not by Justice AV Solutions. It carried an Authenticode certificate for Vanguard Tech Limited and included fffmpeg.exe, with three leading f characters. That file ran from the JAVS Viewer installation directory and established command-and-control traffic.

The backdoor sent host details to 45.120.177.178, maintained a persistent connection, and launched obfuscated PowerShell. Rapid7 later found second-stage binaries on the actor's infrastructure, including browser-credential theft tooling and StealC-related payloads.

JAVS pulled Viewer 8.3.7, reset passwords, audited systems, and said source code, certificates, systems, and other releases were not compromised. Rapid7 and JAVS both recommended reimaging affected machines, resetting credentials, and installing a clean 8.3.8 or later release.

Motive

Espionage Remote Access

Cause

Compromised Installer

Transitive

No

• CVE-2024-4978: Backdoored Justice AV Solutions Viewer Software Used in Apparent Supply Chain Attackrapid7.com
• CVE-2024-4978 Detailnvd.nist.gov
• CISA Adds One Known Exploited Vulnerability to Catalogcisa.gov