njRAT trojan

njRAT trojan

The njRAT, also known as Bladabindi, is a remote access trojan that has become one of the most popular RATs in the world, with an abundance of educational information available to interested attackers. Once it infects a computer, njRAT copies itself into any string.exe to ensure it activates every time the victim switches on their computer.

njRAT is a versatile trojan, with capabilities that include logging keystrokes, accessing the victim's camera, stealing credentials stored in browsers, opening a reverse shell, uploading and downloading files, viewing the victim's desktop, and manipulating processes, files, and the registry. It can also allow the attacker to update, uninstall, restart, close, disconnect the trojan, and rename its campaign ID through the Command & Control server. However, using a SIEM solution with MITRE ATT&CK implementation can help detect and stop njRAT attacks in multiple stages.

In this video, we talk about what njRAT is, how it spreads, and ways to mitigate the trojan. Watch the video to learn more—three minutes is all it takes!