njRAT

njRAT, also known as Bladabindi and NJW0rm, is a commodity Windows remote access Trojan written for the .NET ecosystem and widely used by cybercriminal and espionage operators. It provides persistent unauthorized remote access and supports interactive surveillance and follow-on payload delivery. Documented capabilities include keylogging, screenshot capture, webcam access, microphone control, download-and-execute of additional malware, registry querying and modification, current-user enumeration, camera detection, removable-drive detection, and process-injection-related behavior. Analysis of staged infections has also shown socket-based data transmission and heavy use of obfuscation across intermediate loaders and scripts.

Observed delivery chains include spearphishing and phishing lures using weaponized Office documents with macros or exploit documents, as well as staged script-based loaders that retrieve additional components from paste or text-hosting services. njRAT has also appeared in broader malware distribution ecosystems involving crypters and commodity loaders, and has been distributed by actors using email campaigns and socially engineered lures. In some campaigns it has been dropped alongside or instead of other commodity RATs such as AsyncRAT, Remcos, and XWorm.

njRAT has been used by multiple threat actors and intrusion sets, including activity associated with Aquatic Panda, TA558, Gamaredon, and Transparent Tribe-related operations. It has been observed in campaigns targeting government, diplomatic, military, and regional victims, including Indian and Ukrainian targets, as well as in more general cybercriminal operations. Its longevity, low barrier to acquisition, and broad surveillance feature set have made it a recurring tool in both opportunistic and targeted intrusions.