njq8

njq8 is the moniker associated with the author of the njRAT remote access trojan and the related njw0rm malware family. The activity is linked to malware development rather than a clearly defined intrusion set, with infrastructure observations placing associated command-and-control operations largely in the Middle East. Reporting has also associated the persona with Kuwait. Malware attributed to njq8 includes commodity remote-access and credential-theft functionality. njw0rm supports command execution, attacker-directed updates, host reconnaissance, and periodic beaconing to command-and-control servers. It also steals credentials from common applications and services, including browser-stored passwords, FTP client credentials, and dynamic DNS account data. A notable characteristic of njw0rm is worm-like propagation through removable media: it monitors USB drives, hides existing folders, and replaces them with malicious shortcut files to trigger execution and spread. Observed delivery methods for njw0rm include malicious links in emails and drive-by downloads from compromised websites. The malware shares protocol traits with njRAT, indicating common authorship and lineage. At the time of reporting, njw0rm had been observed in the wild as an evolving malware family, but not in confirmed targeted attacks. Overall, njq8 is best characterized as a malware author associated with broadly distributed remote-access and credential-theft tooling rather than a clearly delineated state-backed threat group.