SpicyOmelette

Executive Summary

SpicyOmelette is a JavaScript-based RAT deployed by Cobalt Group since at least 2018, targeting Windows machines through malicious web content. It provides remote control capabilities such as file manipulation, exfiltration, and monitoring commands via an out‑of‑band web connection. This tool illustrates the threat actor's focus on stealthy, cross‑platform delivery mechanisms that bypass traditional binary detection, increasing the risk of unnoticed persistence within enterprise networks.

SpicyOmelette is a JavaScript-based Remote Access Tool (RAT) first identified by Secureworks in September 2018 within the GOLD KINGSWOOD investigation of Cobalt Group activity. The malware operates primarily on Windows systems, leveraging malicious JavaScript code to establish persistent remote control over compromised hosts. The RAT embeds itself into web pages or email attachments that are rendered by an infected victim’s browser. Once executed, it creates a backdoor channel to the command and control (C2) infrastructure controlled by the threat actor. From there, SpicyOmelette can receive arbitrary commands for information gathering, file manipulation, screen capture, keystroke logging, and lateral movement across a target network. Security analysts routinely see SpicyOmelette delivering updates, exfiltrating data, and maintaining persistence through scheduled tasks or registry run keys. Its use of JavaScript—an uncommon choice for RATs—can allow it to evade traditional signature‑based defenses that focus on binary payloads. It has been linked explicitly with the Cobalt Group’s broader adversary campaigns targeting enterprise environments across multiple industries. Understanding SpicyOmelette's behavior is crucial for organizations that rely heavily on web-based applications, as the malware can masquerade as legitimate JavaScript files. Detection often centers around anomalous outbound HTTP/HTTPS traffic to known malicious domains and the presence of obfuscated or encoded script payloads within Office documents or browser extensions.

Key Capabilities

• Persistent remote access to Windows hosts
• Exfiltration of files and data via HTTP/HTTPS
• Remote execution of arbitrary commands using JavaScript
• Screen capture and keystroke logging
• Establishes command and control channel over malicious domains

ATT&CK Techniques

Recommended Actions

• Block outbound traffic to known or newly discovered SpicyOmelette C2 domains.
• Detect and quarantine suspicious JavaScript files delivered through email attachments or web pages.
• Implement endpoint detection that monitors for unusual use of PowerShell/JavaScript interpreters executing network communications.
• Disable automatic script execution in browsers and Office products unless absolutely required.
• Perform regular integrity checks on Windows registry keys and scheduled tasks for unauthorized entries.

Suggested Tags