njRAT

NjRAT is a remote-access Trojan (RAT) that has been in use since 2013, often deployed in both criminal and targeted attacks. This malware can infiltrate systems via suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside a system, NjRAT can steal personal information, disrupt operations, or even hold data for ransom. It is capable of identifying remote hosts on connected networks (T1018), detecting peripheral devices such as cameras during initial infection (T1120), and executing keylogging, stealing, reverse shell, and USB propagation functions. The attackers have been observed using a variety of RATs including Remcos, AsyncRAT, Lime-RAT, Quasar RAT, and BitRAT, along with NjRAT. Interestingly, it has been noted that RATs like NjRAT and infostealers like Lokibot leverage the same Command and Control (C2) infrastructure as targeted attacks. These tactics include customizing publicly available RATs like NjRAT and AsyncRAT for espionage or financial theft. The BlindEagle group, also known as APT-C-36, has been seen running operations using NjRAT among other RATs. In recent developments, manufacturing organizations across North America have been targeted by the financially motivated Blind Eagle threat operation. The attackers leveraged the Ande Loader malware to deliver remote access trojans, including NjRAT. The campaign employed this loader to deliver both Remcos RAT and NjRAT. These attacks were facilitated by phishing emails containing RAR and BZ2 archives, which led to the distribution of NjRAT.