Loading malware…
njRAT, also known as Bladabindi, is a Windows remote access trojan implemented in .NET that has circulated since approximately 2012. Widely shared and reused in criminal communities, including Middle Eastern underground forums, it enables unauthorized remote control, surveillance, and information theft. Its capabilities include keylogging, browser credential theft, remote shell and desktop access, file management, downloading and executing additional files, plugin execution, and discovery of other hosts on connected networks. Some variants also support distributed denial-of-service attacks, and modified versions have incorporated cryptocurrency mining.
Distribution includes phishing and spearphishing, malicious archives exploiting WinRAR vulnerabilities, and removable-media propagation. Documented campaigns have exploited CVE-2018-20250 and CVE-2023-38831 to deliver njRAT. USB-propagating variants hide malicious copies on removable drives and use deceptive shortcuts to induce execution. Persistence mechanisms include startup shortcuts and registry-based autorun entries. Fileless deployment variants store encoded payloads in the registry and use PowerShell reflective loading to execute them in memory. Obfuscation and changes to firewall settings provide additional defense evasion; external deployment chains have also injected njRAT into legitimate Windows processes through process hollowing.
njRAT has been deployed by both criminal and espionage-oriented operators, including TA558 and Blind Eagle, also known as APT-C-36. Blind Eagle campaigns used Spanish-language spearphishing impersonating Colombian official institutions. Its widely reused codebase has also served as the basis for derivative malware, including KGB RAT.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2023-38831 is a vulnerability that enables malicious actors to execute arbitrary code when a user tries to access a harmless file contained within a ZIP archive.
On March 17, 2019, QiAnXin Threat Intelligence Center captured a target attack sample against the Middle East by exploiting WinRAR vulnerability (CVE-2018-20250). When the archive gets decompressed on the vulnerable computer, the embedded njRAT backdoor (Telegram Desktop.exe) will be extracted to the startup folder.
The initial access portion of this attack began on the exchange servers in the targeted environment, when a web shell file was dropped in the public access folders in early September 2022 via ProxyShell exploitation.
The initial access portion of this attack began on the exchange servers in the targeted environment, when a web shell file was dropped in the public access folders in early September 2022 via ProxyShell exploitation.
The initial access portion of this attack began on the exchange servers in the targeted environment, when a web shell file was dropped in the public access folders in early September 2022 via ProxyShell exploitation.
As early as January 4, attackers started exploiting the CVE-2021-44228 vulnerability in internet-facing systems running VMware Horizon. Our investigation shows that successful intrusions in these campaigns led to the deployment of the NightSky ransomware. | We’ve also seen Meterpreter, Bladabindi, and HabitsRAT.
When analyzing the organization’s CVE-2017-11882 exploit document, we found that the way to bypass the shellcode length limitation is similar to that used by the APT organization TA505... Unlike most previous CVE-2017-11882 exploits, Bayworld uses malicious code in xlsx files.
Associated Analytic Story ... NjRAT
the attachment was a weaponized RTF document utilizing CVE-2012-0158 to drop an embedded, encoded portable executable (PE)... In multiple lure documents, Type: Exploit, CVE-2012-0158, Embedded Payload. | This site is likely operated by the same actor(s) that carried out the previously discussed attacks on Indian embassy officials based on shared C&C infrastructure... lure Indian military officials into becoming infected with MSIL/Crimson, njRAT, and possibly other malicious tools.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
28 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
В их арсенале находятся такие вредоносные программы, как AgentTesla, Remcos, njRAT и другие.
APT41 and APT36 have both employed NjRAT, while APT10 has used QuasarRAT.
APT41 and APT36 have both employed NjRAT, while APT10 has used QuasarRAT.
When the archive gets decompressed on the vulnerable computer, the embedded njRAT backdoor (Telegram Desktop.exe) will be extracted to the startup folder and then triggered into execution if the victim restarts the computer or performs re-login.
From December 2, 2022 until February 2, 2023, multiple campaigns were observed deploying NjRat in its final stage.
From December 2, 2022 until February 2, 2023, multiple campaigns were observed deploying NjRat in its final stage.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
894 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a modern remote access Trojan used by criminal groups. No family-specific technical behavior or campaign details are provided.
Windows .NET RAT offering keylogging, webcam and microphone access, file management, browser credential theft, USB propagation, and plugins. Leaked builders have sustained widespread use. Default TCP port 5552 and a distinctive C2 delimiter are hunting leads, not definitive identifiers.
Established remote access trojan that serves as the underlying basis for KGB RAT. The content describes its use by attackers with varying skill levels but provides no separate technical analysis of NjRAT.
An existing remote access trojan whose obfuscated code forms the basis of analyzed KGB RAT samples. The article describes KGB RAT as building on this existing malware code and adding a commercial service package.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.