Loading story…
Palo Alto Networks Unit 42 reported that an njRAT campaign used Pastebin as a pseudo-command-and-control channel and staging service to distribute second-stage malware. The activity had been observed since at least October 2020, with njRAT downloaders pulling payloads or configuration data from Pastebin instead of relying solely on attacker-controlled infrastructure, a tactic that can help blend malicious traffic with legitimate web activity and complicate blocking efforts.
Researchers said the malware retrieved content through several methods, including base64, reversed base64, hex-to-base64 conversion, gzip-compressed base64, direct URL references, JSON, and HTML parsing. In multiple cases, the second-stage payloads were 32-bit .NET executables with Trojan and keylogging functionality, and one sample used Pastebin to direct victims to a remote executable hosted at textfiles[.]us; the report also included related hashes, Pastebin URLs, and vendor detection coverage for the campaign.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported that malware authors had used njRAT, also known as Bladabindi, since at least October 2020 to retrieve second-stage payloads and configuration data from Pastebin. The activity used Pastebin as a public hosting and pseudo-command-and-control service to avoid maintaining attacker-owned C2 infrastructure.
Unit 42 published research describing multiple njRAT delivery patterns that pulled malicious content from Pastebin in formats including base64, reversed base64, hex, gzip-compressed blobs, JSON, direct links, and HTML-parsed pages. The report said the Pastebin tunnel remained active and provided hashes, Pastebin URLs, and detection coverage for the campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 76 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple reports documented continued **njRAT** (also known as **Bladabindi**) activity delivered through diverse infection chains, including malicious PowerPoint macros, phishing attachments, password-protected archives, trojanized software on Korean webhard sites, compiled AutoHotKey loaders, and typosquatted npm packages. The malware was shown using layered obfuscation in VBS and PowerShell, Base64-encoded payloads, reflective or in-memory loading, and staged retrieval from services such as `paste.ee`, `archive.org`, `wtools.io`, and dynamic DNS infrastructure. In one supply-chain case, the npm packages `jdb.js` and `db-json.js` installed a .NET payload that copied itself as `dchps.exe` and connected to `46.185.116.2:5552`, while other campaigns used domains including `fidapeste2.duckdns.org`, `xxxcarldon.duckdns.org`, and `0.tcp.eu.ngrck.io` for command and control. Analysis of multiple samples showed njRAT maintaining persistence through **Startup folder** copies, **registry Run keys**, shortcuts, mutexes, firewall-rule changes, and even `netsh` exclusions, while some variants bundled legitimate applications so victims would not notice the infection. Once active, the RAT collected host profiling data and supported a broad set of attacker functions, including **keylogging, credential theft, webcam access, screenshot and screen viewing, file transfer, process and registry manipulation, remote shell access, and full remote control** of Windows systems. Reports also linked njRAT delivery to long-running loader ecosystems that rotated payload families such as Houdini, LimeRAT, RevengeRAT, AsyncRAT, and VjW0rm, underscoring the malware’s persistence as a flexible commodity RAT used across phishing, malware-hosting, and software supply-chain abuse.
Aug 15, 2026
Researchers documented continued use of **njRAT** (also known as **Bladabindi**) in targeted intrusion campaigns alongside other commodity and custom remote access trojans. Cisco Talos said the **SideCopy** APT, which targets government personnel and other entities in India, incorporated njRAT into multi-stage infection chains that often begin with malicious `.LNK` files and progress through HTAs and loader DLLs before deploying RATs and post-compromise plugins for credential theft, file enumeration, and keylogging. ESET separately reported **Operation Spalax**, a phishing-driven campaign aimed at Colombian government institutions and private-sector organizations, especially in the energy and metallurgical sectors, where attackers used shortened links, RAR archives, and multiple droppers to install njRAT, **Remcos**, and **AsyncRAT** for surveillance and remote control. A technical analysis of an **njRAT 0.6.4** sample tied to the campaign ID `splitgateukrayna` showed how the malware persists by copying itself to `%AppData%\services64.exe`, creating a Run registry key, adding a Windows Firewall exception, and using the mutex `49e91d08e684b1770e0cefa60401157a`. The sample connected to `44gang44.duckdns[.]org` on port `2222`, profiled infected systems, and supported a broad set of capabilities including hidden shell execution, keylogging, screenshot capture, registry manipulation, plugin loading, payload download-and-execute, self-update, and uninstall. Across the reported campaigns, njRAT remained a flexible, low-cost espionage tool used to establish persistence, collect victim data, and enable long-term remote access.
Aug 15, 2026
Researchers identified two active remote access trojan operations built on commodity malware families, with one involving a customized QuasarRAT variant dubbed **DollRAT** or **"Lilly's RAT V8"** and the other using **njRAT v0.7d (Bladabindi)**. DollRAT was observed using a modified QuasarRAT `v1.4.1` codebase with **ConfuserEx** obfuscation, runtime string decryption, and command-and-control traffic routed through an **ngrok** TCP tunnel at `0.tcp.eu.ngrok.io:18107`, backed by AWS infrastructure in Frankfurt. The malware supports credential theft from browsers and FTP clients, keylogging with HTML-formatted logs, system reconnaissance, remote shell access, file management, remote desktop, registry changes, reverse proxying, and persistence through Run keys and scheduled tasks. Embedded branding including **"Lilly's RAT V8"** and **"C.U.M Software Inc."** suggests an actively maintained custom build rather than an unmodified public RAT. A separate analysis tracked an **njRAT** sample named `Client.exe` to a broader campaign using the hardcoded No-IP hostname `njspider.myddns.me` on TCP port `4444`, resolving to Belgian residential IP `62.235.6.231`. That operation has reportedly been active since at least late 2025, with multiple related binaries and rapid rebuilds sharing the same infrastructure. The njRAT sample retained standard capabilities including persistence via `HKCU` Run keys, keylogging, screenshots, webcam capture, remote shell, file transfer, plugin execution, USB spreading, and plaintext TCP beaconing. Across both cases, operators relied on legitimate services such as **ngrok**, **No-IP**, `ipwho.is`, and `api.ipify.org` to mask or support C2 activity, while the tooling and infrastructure pointed to low-sophistication but active commodity malware operations.
Jun 29, 2026