Ninja Trojan
Ninja Trojan is a sophisticated C++ post-exploitation malware family associated with the ToddyCat APT, an espionage-focused cluster active since at least December 2020. Reporting describes Ninja as part of an unknown ToddyCat post-exploitation toolkit and notes it was deployed in some intrusions by the Samurai backdoor. ToddyCat targeted high-profile entities in Europe and Asia, including government, military, defense-related, and other prominent organizations; early activity involved compromise of Microsoft Exchange servers in Taiwan and Vietnam, including exploitation of Exchange vulnerabilities such as ProxyLogon, while later activity also included desktop-focused delivery via Telegram ZIP archives containing Ninja loaders.
Ninja provides broad operator functionality for post-compromise operations. Documented capabilities include process enumeration and management, filesystem management and operations, multiple reverse shells, process injection, runtime module or plugin loading, and TCP proxying or forwarding between command-and-control and internal hosts. It supports multi-session operator use, can act as a local pivot node relaying traffic for other agents, and can communicate over HTTP, HTTPS, or raw TCP. Its network traffic can be camouflaged through customizable HTTP headers and URL paths in a manner compared to malleable C2 concepts. It also includes a configurable working-time feature to restrict activity to specific time windows and can be reconfigured remotely.
Observed delivery and loading chains include multiple 64-bit DLL loader variants used by ToddyCat. These loaders were executed either via rundll32.exe or through DLL side-loading with legitimate signed executables such as vlc.exe. They decrypted XOR-obfuscated payloads from files in the same directory and then either loaded the next-stage DLL into the current process or injected shellcode into a newly created wusa.exe process. A tailored loader variant stored an encrypted payload at %CommonApplicationData%\Local\user.key and bound decryption to host-specific disk and volume identifiers, assessed as supporting long-term persistence. Additional persistence linked to Ninja deployment included svchost-based service abuse: ToddyCat created or modified service configuration and registry values so svchost.exe would load a malicious ServiceDll, commonly %ProgramFiles%\Common Files\System\apibridge.dll, including use of FontCacheSvc-related registry paths and SvcHost grouping changes.
A newer Ninja version reportedly changed configuration obfuscation from XOR 0xAA to a NOT operation. Reported command-and-control indicators for Ninja include hxxps://solitary-dawn-61af.mfeagents.workers[.]dev/collector/3.0/, IP 149.28.28[.]159, and domain eohsdnsaaojrhnqo.windowshost[.]us.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"From February 26 until early March, we observed a quick escalation and the attacker abusing the ProxyLogon vulnerability to compromise multiple organizations across Europe and Asia."
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"In specific cases the Samurai backdoor was used to deploy another sophisticated malware that we dubbed Ninja, a tool developed in C++, likely a part of an unknown post-exploitation toolkit developed by ToddyCat."
IOCs tracked for this family
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Sophisticated post-exploitation agent providing process and file management, multiple reverse shells, arbitrary process injection, runtime module loading (plugin-like), and proxying/forwarding TCP traffic between C2 and internal hosts.
An in-memory C++ post-exploitation agent providing deep remote control: process and filesystem management, multiple reverse shells, process injection, runtime plugin loading, and TCP proxy/pivoting. It supports HTTP/HTTPS/TCP C2 with configurable headers/paths to blend traffic (Cobalt Strike-like ‘malleable’ behavior), optional working-hours execution, and a local server mode to relay traffic for chained pivoting inside intranets.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.