RAT / stealerATT&CK S0385
njRAT
Also known as: Bladabindi, Njw0rm, LV
njRAT is a remote access trojan written in .NET that has circulated freely for over a decade, so it is used by everyone from low-skill criminals to state-linked groups. It gives an attacker full control of a Windows computer, including keylogging, webcam access and file transfer, and some versions spread through USB drives.
- Public attribution and associated actors
- Widely available; MITRE ATT&CK lists many users, including APT41, Transparent Tribe, APT-C-36 and TA2541.As publicly reported:APT41Transparent TribeAPT-C-36
- First seen
- Around 2013
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0385 njRAT
How it spreads or gets in
- Phishing attachments, fake downloads and copying itself to removable drives.
Key behaviours
- Logged keystrokes and captured the screen and webcam.
- Stole saved browser credentials.
- Added itself to Run keys and could open firewall exceptions.
ATT&CK techniques
- T1056.001Input Capture: Keylogging
- T1125Video Capture
- T1113Screen Capture
- T1555.003Credentials from Password Stores: Credentials from Web Browsers
- T1091Replication Through Removable Media
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1021.001Remote Services: Remote Desktop Protocol
- T1568.001Dynamic Resolution: Fast Flux DNS
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on new firewall exceptions created by user-space programs.
- Detect executables launched from removable drives.
- Flag connections to dynamic DNS domains from workstations.
Defences that work
- Disable autorun and control removable media.
- Filter attachments and block unapproved software.
- Use application control so unknown .NET executables cannot run from user folders.