NjRAT (also known as Bladabindi, tracked as MITRE ATT&CK S0385) is a .NET-based remote access trojan that has been active since November 2012. After its source code was leaked in 2013, it became one of the most widely deployed RATs in history — used by everyone from script kiddies to nation-state groups including Group5 (Iran) and SideCopy (Pakistan).
Overview & History
NjRAT was originally developed by a Kuwaiti developer using the handle "njq8" and released on Arabic-language hacking forums. The malware's source code leak in 2013 transformed it from a niche tool into a global phenomenon, spawning dozens of variants and forks that continue to proliferate in 2026.
NjRAT has been continuously active for 13+ years, consistently ranking among the top 10 most-detected RATs globally. Its longevity stems from the combination of source code availability, GUI-based builder simplicity, and continuous community-driven development.
- Language: .NET Framework (C#/VB.NET); requires .NET runtime on target
- Builder: GUI-based builder generates configured RAT payloads with point-and-click simplicity
- Source code: Publicly available since 2013; hundreds of forks on GitHub and hacking forums
- Default port: TCP 5552 (configurable via builder)
- Primary targets: Middle East, South/Southeast Asia, Latin America
Builder & Capabilities
NjRAT's GUI builder is the key to its proliferation. It allows operators with minimal technical skill to generate fully functional RAT payloads:
Core RAT Features
- Remote desktop: Full screen viewing and control of infected systems T1219
- Keylogging: Records all keystrokes and saves to log files T1056.001
- File manager: Browse, upload, download, and delete files on victim systems T1005
- Webcam capture: Live webcam streaming and screenshot capture T1125
- Microphone recording: Audio capture from system microphone T1123
- Credential theft: Browser password extraction T1555.003
- Shell access: Remote command prompt with full system access T1059.003
- Process/registry management: View, kill processes; edit registry entries
Destructive Capabilities
- MBR wiper: Can overwrite the Master Boot Record, rendering the system unbootable
- DDoS module: HTTP/UDP/TCP flood attacks against specified targets T1498
- Ransomware module: Some variants include basic file encryption functionality
Technical Analysis
Execution & Persistence
- Initial execution: Typically arrives as a compiled .NET executable disguised as legitimate software
- Self-copy: Copies itself to
%APPDATA%or%TEMP%with randomized or system-mimicking names T1036 - Registry persistence: Adds Run key entry for automatic startup T1547.001
- Startup folder: Places shortcut in user's Startup folder as backup persistence
- Mutex: Creates a named mutex to prevent multiple instances
C2 Protocol
- Protocol: Custom TCP protocol over configurable port (default 5552) T1095
- Delimiter: Commands and data separated by pipe character (
|) - Encoding: Base64 encoding for data transfer
- Keep-alive: Regular heartbeat packets to maintain connection
USB Worm Module
NjRAT includes a USB worm module that copies itself to removable drives and creates autorun entries, enabling offline propagation across air-gapped networks.
- Monitors for new USB drive connections T1091
- Copies payload to drive root with hidden attributes
- Creates or modifies
autorun.inffor automatic execution - Hides original files and creates disguised shortcuts
Variants & Forks
| Variant | Key Features |
|---|---|
| NjRAT (Original) | Core RAT functionality; GUI builder; source leaked 2013 |
| Lime Edition | Added DDoS, Bitcoin mining, USB spread, ransomware module |
| NjRAT 0.7d Golden | Enhanced evasion; persistence improvements; community fork |
| NjRAT Green Edition | Improved stability; additional stealer modules |
| njRAT Danger Edition | Advanced features; botnet management improvements |
| Custom APT variants | Heavily modified versions used by state-sponsored groups |
Threat Actor Usage
| Threat Actor | Region | Usage Context |
|---|---|---|
| Group5 | Iran | Espionage against Syrian opposition and diaspora communities |
| SideCopy | Pakistan | Operations targeting Indian military and government entities |
| Earth Bogle | Middle East | Geopolitically motivated campaigns across MENA region |
| BlindEagle (APT-C-36) | Latin America | Financial espionage targeting Colombian entities |
| Gorgon Group | Pakistan | Dual espionage and cybercrime operations |
| Script kiddies (global) | Worldwide | Low-sophistication attacks, gaming community targeting |
MITRE ATT&CK Mapping
| Tactic | Technique | Usage |
|---|---|---|
| Persistence | T1547.001 Registry Run Keys | Autostart persistence via HKCU Run key |
| Defense Evasion | T1036 Masquerading | Mimics legitimate system process names |
| Credential Access | T1056.001 Keylogging | Records all keystrokes |
| Credential Access | T1555.003 Browser Credentials | Extracts saved browser passwords |
| Collection | T1125 Video Capture | Webcam streaming and capture |
| Collection | T1123 Audio Capture | Microphone recording |
| Collection | T1113 Screen Capture | Desktop screenshots |
| Collection | T1005 Data from Local System | File browsing and exfiltration |
| Lateral Movement | T1091 Replication via Media | USB worm propagation |
| C2 | T1095 Non-Application Layer | Custom TCP protocol on port 5552 |
Microsoft Dev Tunnels Abuse (2025)
In early 2025, NjRAT operators began abusing Microsoft Dev Tunnels — a legitimate developer service for exposing local ports to the internet — as C2 infrastructure. This technique routes all C2 traffic through Microsoft's trusted infrastructure, bypassing domain reputation checks.
- Mechanism: Operator runs Dev Tunnel on their machine, connecting NjRAT listener to a
*.devtunnels.msURL - Advantage: C2 traffic appears as HTTPS connections to Microsoft-owned domains
- Detection challenge: Traditional IOC-based blocking is ineffective against legitimate Microsoft infrastructure
- Mitigation: Monitor for Dev Tunnel connections from non-developer systems; restrict Dev Tunnel access via Azure AD policies
Detection & Defense
- .NET runtime monitoring: Track .NET process execution from unusual locations (
%TEMP%,%APPDATA%) - Network signatures: Detect NjRAT's pipe-delimited TCP protocol and Base64-encoded command patterns
- Registry monitoring: Alert on new HKCU Run key entries pointing to executables in temp/appdata directories
- USB policy: Enforce USB device control policies to prevent autorun-based propagation
- Dev Tunnels restriction: Block or monitor
*.devtunnels.msconnections from non-developer endpoints - YARA rules: NjRAT's .NET structure is well-characterized; community YARA rules available from multiple vendors
- Application whitelisting: Prevent execution of unsigned .NET binaries from user directories
Protect Against Remote Access Trojans
Mjolnir Security provides comprehensive RAT detection, response, and prevention services.
- RAT Detection & Removal Identify and remediate NjRAT infections including all variants, persistence mechanisms, and lateral movement artifacts across your environment.
- Infrastructure Abuse Detection Monitor for abuse of legitimate services (Dev Tunnels, ngrok, Cloudflare Tunnels) as C2 channels that bypass traditional security controls.
- 24/7 Incident Response Rapid containment and forensic investigation when RAT activity is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts