NjRAT (also known as Bladabindi, tracked as MITRE ATT&CK S0385) is a .NET-based remote access trojan that has been active since November 2012. After its source code was leaked in 2013, it became one of the most widely deployed RATs in history, used by everyone from script kiddies to nation-state groups including Group5 (Iran) and SideCopy (Pakistan).
Overview & History
NjRAT was originally developed by a Kuwaiti developer using the handle "njq8" and released on Arabic-language hacking forums. The malware's source code leak in 2013 transformed it from a niche tool into a global phenomenon, spawning dozens of variants and forks that continue to proliferate in 2026.
NjRAT has been continuously active for 13+ years, consistently ranking among the top 10 most-detected RATs globally. Its longevity stems from the combination of source code availability, GUI-based builder simplicity, and continuous community-driven development.
- Language: .NET Framework (C#/VB.NET); requires .NET runtime on target
- Builder: GUI-based builder generates configured RAT payloads with point-and-click simplicity
- Source code: Publicly available since 2013; hundreds of forks on GitHub and hacking forums
- Default port: TCP 5552 (configurable via builder)
- Primary targets: Middle East, South/Southeast Asia, Latin America
Builder & Capabilities
NjRAT's GUI builder is the key to its proliferation. It allows operators with minimal technical skill to generate fully functional RAT payloads:
Core RAT Features
- Remote desktop: Full screen viewing and control of infected systems T1219
- Keylogging: Records all keystrokes and saves to log files T1056.001
- File manager: Browse, upload, download, and delete files on victim systems T1005
- Webcam capture: Live webcam streaming and screenshot capture T1125
- Microphone recording: Audio capture from system microphone T1123
- Credential theft: Browser password extraction T1555.003
- Shell access: Remote command prompt with full system access T1059.003
- Process/registry management: View, kill processes; edit registry entries
Destructive Capabilities
- MBR wiper: Can overwrite the Master Boot Record, rendering the system unbootable
- DDoS module: HTTP/UDP/TCP flood attacks against specified targets T1498
- Ransomware module: Some variants include basic file encryption functionality
Technical Analysis
Execution & Persistence
- Initial execution: Typically arrives as a compiled .NET executable disguised as legitimate software
- Self-copy: Copies itself to
%APPDATA%or%TEMP%with randomized or system-mimicking names T1036 - Registry persistence: Adds Run key entry for automatic startup T1547.001
- Startup folder: Places shortcut in user's Startup folder as backup persistence
- Mutex: Creates a named mutex to prevent multiple instances
C2 Protocol
- Protocol: Custom TCP protocol over configurable port (default 5552) T1095
- Delimiter: Commands and data separated by pipe character (
|) - Encoding: Base64 encoding for data transfer
- Keep-alive: Regular heartbeat packets to maintain connection
USB Worm Module
NjRAT includes a USB worm module that copies itself to removable drives and creates autorun entries, enabling offline propagation across air-gapped networks.
- Monitors for new USB drive connections T1091
- Copies payload to drive root with hidden attributes
- Creates or modifies
autorun.inffor automatic execution - Hides original files and creates disguised shortcuts
Variants & Forks
| Variant | Key Features |
|---|---|
| NjRAT (Original) | Core RAT functionality; GUI builder; source leaked 2013 |
| Lime Edition | Added DDoS, Bitcoin mining, USB spread, ransomware module |
| NjRAT 0.7d Golden | Enhanced evasion; persistence improvements; community fork |
| NjRAT Green Edition | Improved stability; additional stealer modules |
| njRAT Danger Edition | Advanced features; botnet management improvements |
| Custom APT variants | Heavily modified versions used by state-sponsored groups |
Threat Actor Usage
| Threat Actor | Region | Usage Context |
|---|---|---|
| Group5 | Iran | Espionage against Syrian opposition and diaspora communities |
| SideCopy | Pakistan | Operations targeting Indian military and government entities |
| Earth Bogle | Middle East | Geopolitically motivated campaigns across MENA region |
| BlindEagle (APT-C-36) | Latin America | Financial espionage targeting Colombian entities |
| Gorgon Group | Pakistan | Dual espionage and cybercrime operations |
| Script kiddies (global) | Worldwide | Low-sophistication attacks, gaming community targeting |
MITRE ATT&CK Mapping
| Tactic | Technique | Usage |
|---|---|---|
| Persistence | T1547.001 Registry Run Keys | Autostart persistence via HKCU Run key |
| Defense Evasion | T1036 Masquerading | Mimics legitimate system process names |
| Credential Access | T1056.001 Keylogging | Records all keystrokes |
| Credential Access | T1555.003 Browser Credentials | Extracts saved browser passwords |
| Collection | T1125 Video Capture | Webcam streaming and capture |
| Collection | T1123 Audio Capture | Microphone recording |
| Collection | T1113 Screen Capture | Desktop screenshots |
| Collection | T1005 Data from Local System | File browsing and exfiltration |
| Lateral Movement | T1091 Replication via Media | USB worm propagation |
| C2 | T1095 Non-Application Layer | Custom TCP protocol on port 5552 |
Microsoft Dev Tunnels Abuse (2025)
In early 2025, NjRAT operators began abusing Microsoft Dev Tunnels, a legitimate developer service for exposing local ports to the internet, as C2 infrastructure. This technique routes all C2 traffic through Microsoft's trusted infrastructure, bypassing domain reputation checks.
- Mechanism: Operator runs Dev Tunnel on their machine, connecting NjRAT listener to a
*.devtunnels.msURL - Advantage: C2 traffic appears as HTTPS connections to Microsoft-owned domains
- Detection challenge: Traditional IOC-based blocking is ineffective against legitimate Microsoft infrastructure
- Mitigation: Monitor for Dev Tunnel connections from non-developer systems; restrict Dev Tunnel access via Azure AD policies
Detection & Defense
- .NET runtime monitoring: Track .NET process execution from unusual locations (
%TEMP%,%APPDATA%) - Network signatures: Detect NjRAT's pipe-delimited TCP protocol and Base64-encoded command patterns
- Registry monitoring: Alert on new HKCU Run key entries pointing to executables in temp/appdata directories
- USB policy: Enforce USB device control policies to prevent autorun-based propagation
- Dev Tunnels restriction: Block or monitor
*.devtunnels.msconnections from non-developer endpoints - YARA rules: NjRAT's .NET structure is well-characterized; community YARA rules available from multiple vendors
- Application whitelisting: Prevent execution of unsigned .NET binaries from user directories
Protect Against Remote Access Trojans
Mjolnir Security provides comprehensive RAT detection, response, and prevention services.
- RAT Detection & Removal Identify and remediate NjRAT infections including all variants, persistence mechanisms, and lateral movement artifacts across your environment.
- Infrastructure Abuse Detection Monitor for abuse of legitimate services (Dev Tunnels, ngrok, Cloudflare Tunnels) as C2 channels that bypass traditional security controls.
- 24/7 Incident Response Rapid containment and forensic investigation when RAT activity is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts