Loading story…
Researchers documented continued use of njRAT (also known as Bladabindi) in targeted intrusion campaigns alongside other commodity and custom remote access trojans. Cisco Talos said the SideCopy APT, which targets government personnel and other entities in India, incorporated njRAT into multi-stage infection chains that often begin with malicious .LNK files and progress through HTAs and loader DLLs before deploying RATs and post-compromise plugins for credential theft, file enumeration, and keylogging. ESET separately reported Operation Spalax, a phishing-driven campaign aimed at Colombian government institutions and private-sector organizations, especially in the energy and metallurgical sectors, where attackers used shortened links, RAR archives, and multiple droppers to install njRAT, Remcos, and AsyncRAT for surveillance and remote control.
A technical analysis of an njRAT 0.6.4 sample tied to the campaign ID splitgateukrayna showed how the malware persists by copying itself to %AppData%\services64.exe, creating a Run registry key, adding a Windows Firewall exception, and using the mutex 49e91d08e684b1770e0cefa60401157a. The sample connected to 44gang44.duckdns[.]org on port 2222, profiled infected systems, and supported a broad set of capabilities including hidden shell execution, keylogging, screenshot capture, registry manipulation, plugin loading, payload download-and-execute, self-update, and uninstall. Across the reported campaigns, njRAT remained a flexible, low-cost espionage tool used to establish persistence, collect victim data, and enable long-term remote access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
A public analysis examined an njRAT v0.6.4 sample associated with the campaign ID "splitgateukrayna," detailing persistence, host profiling, C2 communications to 44gang44.duckdns[.]org:2222, and capabilities including keylogging, screenshots, plugin loading, and payload execution.
Alongside its SideCopy report, Cisco Talos published Snort SIDs 57842 through 57849 and ClamAV signatures covering malware including njRAT, EpicenterRAT, Lilith, DetaRAT, ReverseRAT, ActionRAT, and AllakoreRAT.
Cisco Talos reported increased SideCopy activity targeting government personnel in India and documented the group's use of njRAT, Allakore, Lilith, Epicenter, and four newly identified custom RAT families: DetaRAT, ReverseRAT, MargulasRAT, and ActionRAT.
ESET disclosed Operation Spalax as an ongoing campaign targeting Colombian organizations and documented its phishing lures, delivery chains, infrastructure, and use of commodity RATs including njRAT.
ESET observed at least 24 IP addresses and around 70 active domains supporting the attackers' infrastructure in the second half of 2020, with new domains registered regularly. Some infrastructure used dynamic DNS and likely compromised devices as proxies.
ESET observed several attacks in 2020 that exclusively targeted Colombian government institutions and private companies, especially in the energy and metallurgical sectors. The campaign used phishing to deliver RATs including Remcos, njRAT, and AsyncRAT for surveillance.
Trend Micro published a report in July 2019 describing activity with similarities in phishing and parts of the infrastructure later seen in Operation Spalax, though it linked that activity to cybercrime rather than espionage.
QiAnXin published a report in February 2019 describing operations connected to an APT that had been active since at least April 2018. ESET later noted overlaps between this earlier activity and Operation Spalax.
Cisco Talos said SideCopy had used commodity RATs such as njRAT, Lilith, and Epicenter since as early as 2019, alongside its custom malware development.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybergeeks.tech
Open sourceblog.talosintelligence.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple reports documented continued **njRAT** (also known as **Bladabindi**) activity delivered through diverse infection chains, including malicious PowerPoint macros, phishing attachments, password-protected archives, trojanized software on Korean webhard sites, compiled AutoHotKey loaders, and typosquatted npm packages. The malware was shown using layered obfuscation in VBS and PowerShell, Base64-encoded payloads, reflective or in-memory loading, and staged retrieval from services such as `paste.ee`, `archive.org`, `wtools.io`, and dynamic DNS infrastructure. In one supply-chain case, the npm packages `jdb.js` and `db-json.js` installed a .NET payload that copied itself as `dchps.exe` and connected to `46.185.116.2:5552`, while other campaigns used domains including `fidapeste2.duckdns.org`, `xxxcarldon.duckdns.org`, and `0.tcp.eu.ngrck.io` for command and control. Analysis of multiple samples showed njRAT maintaining persistence through **Startup folder** copies, **registry Run keys**, shortcuts, mutexes, firewall-rule changes, and even `netsh` exclusions, while some variants bundled legitimate applications so victims would not notice the infection. Once active, the RAT collected host profiling data and supported a broad set of attacker functions, including **keylogging, credential theft, webcam access, screenshot and screen viewing, file transfer, process and registry manipulation, remote shell access, and full remote control** of Windows systems. Reports also linked njRAT delivery to long-running loader ecosystems that rotated payload families such as Houdini, LimeRAT, RevengeRAT, AsyncRAT, and VjW0rm, underscoring the malware’s persistence as a flexible commodity RAT used across phishing, malware-hosting, and software supply-chain abuse.
Aug 15, 2026
Researchers identified two active remote access trojan operations built on commodity malware families, with one involving a customized QuasarRAT variant dubbed **DollRAT** or **"Lilly's RAT V8"** and the other using **njRAT v0.7d (Bladabindi)**. DollRAT was observed using a modified QuasarRAT `v1.4.1` codebase with **ConfuserEx** obfuscation, runtime string decryption, and command-and-control traffic routed through an **ngrok** TCP tunnel at `0.tcp.eu.ngrok.io:18107`, backed by AWS infrastructure in Frankfurt. The malware supports credential theft from browsers and FTP clients, keylogging with HTML-formatted logs, system reconnaissance, remote shell access, file management, remote desktop, registry changes, reverse proxying, and persistence through Run keys and scheduled tasks. Embedded branding including **"Lilly's RAT V8"** and **"C.U.M Software Inc."** suggests an actively maintained custom build rather than an unmodified public RAT. A separate analysis tracked an **njRAT** sample named `Client.exe` to a broader campaign using the hardcoded No-IP hostname `njspider.myddns.me` on TCP port `4444`, resolving to Belgian residential IP `62.235.6.231`. That operation has reportedly been active since at least late 2025, with multiple related binaries and rapid rebuilds sharing the same infrastructure. The njRAT sample retained standard capabilities including persistence via `HKCU` Run keys, keylogging, screenshots, webcam capture, remote shell, file transfer, plugin execution, USB spreading, and plaintext TCP beaconing. Across both cases, operators relied on legitimate services such as **ngrok**, **No-IP**, `ipwho.is`, and `api.ipify.org` to mask or support C2 activity, while the tooling and infrastructure pointed to low-sophistication but active commodity malware operations.
Jun 29, 2026
Earth Bogle has targeted victims across the Middle East and North Africa in a malware campaign active since at least mid-2022, using regional geopolitical themes to entice users into opening malicious files. The operation delivers **NjRAT** (also known as **Bladabindi**) through malicious CAB archives, obfuscated VBS droppers, and PowerShell-based loaders, with payloads hosted on public cloud storage services including **files.fm** and **failiem.lv** and retrieved through compromised or spoofed infrastructure such as `gpla[.]gov[.]ly`. Once installed, NjRAT gives the attackers broad remote-access and surveillance capabilities, including information theft, screenshot capture, reverse shell access, file transfer, and registry or process manipulation. The campaign is believed to spread through phishing, file-sharing links, and social platforms such as **Facebook** and **Discord**, while persistence is maintained by placing files under `C:\ProgramData\WindowsHost` and modifying startup-related registry shell folders.
Aug 14, 2026