{
  "family": "bladabindi",
  "sample_count": 3930,
  "category": "rat",
  "description": "Backdoor:MSIL/Bladabindi, widely known as njRAT or Njw0rm, is a prolific Remote Access Trojan (RAT) heavily utilized in Middle Eastern cybercrime and script-kiddie campaigns due to its accessible builder interface.<br><br><b>What is Bladabindi?</b><br>For the victim, Bladabindi is a complete invasion of privacy, enabling attackers to hijack webcams, steal passwords, and manipulate files. For incident responders, Bladabindi is a highly recognizable .NET-based threat. Because its builder software is freely available on underground forums, attackers can easily generate thousands of unique, obfuscated payloads, making it one of the most common RATs encountered in the wild.<br><br><b>Infection Vectors & Threat Hunting</b><br>Bladabindi is typically distributed via spearphishing campaigns, malicious Discord links, or bundled with cracked software on file-sharing sites. Upon execution, the .NET payload drops itself into the <code>%AppData%</code> or <code>%Temp%</code> directory, usually disguising itself as a legitimate Windows process (like <code>svchost.exe</code> or <code>explorer.exe</code>). It establishes persistence via the <code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</code> registry key. Threat hunters should monitor for outbound TCP connections to dynamic DNS providers (e.g., No-IP, DuckDNS), which attackers use to route C2 traffic to their home machines.<br><br><b>Forensic Analysis & Impact</b><br>The impact is comprehensive endpoint compromise. Bladabindi features built-in keylogging, remote desktop viewing, microphone recording, and credential dumping. Incident responders should decompile the captured .NET payload (using tools like dnSpy) to instantly reveal the attacker's C2 domain, port, and campaign identifier, as these are often stored in plaintext or lightly base64-encoded strings within the binary.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Bladabindi",
    "njRAT",
    "Njw0rm"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "Is Bladabindi the same as njRAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes; Bladabindi is a common detection name for the njRAT family (MITRE tracks them together as S0385)."
      }
    },
    {
      "@type": "Question",
      "name": "What can Bladabindi do?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remote control, keylogging, credential theft, and webcam/microphone access."
      }
    },
    {
      "@type": "Question",
      "name": "When was it first seen?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "njRAT/Bladabindi was first observed in 2012."
      }
    },
    {
      "@type": "Question",
      "name": "How does it spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through phishing, malicious downloads, pirated software, and infected USB drives."
      }
    },
    {
      "@type": "Question",
      "name": "How do I reduce the risk?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Avoid pirated software and untrusted downloads, be cautious with attachments, and keep endpoint protection updated."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's njRAT entry (S0385), linked on this page."
      }
    }
  ],
  "faq_count": 6,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1125",
    "T1547.001",
    "T1571"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "sources": [
    {
      "name": "MITRE ATT&CK: njRAT (S0385)",
      "url": "https://attack.mitre.org/software/S0385"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0385",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1571",
      "name": "Non-Standard Port",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the endpoint from the network immediately to sever the attacker's real-time remote access session.",
    "Decompile the malicious .NET executable to extract the C2 domain, and block it enterprise-wide at the firewall.",
    "Force a global password reset for all user accounts, as Bladabindi routinely dumps browser passwords and FTP credentials.",
    "Perform a clean OS reinstallation, as the attacker had full interactive control and may have dropped secondary backdoors."
  ],
  "what_to_avoid": [
    "Do not engage with the attacker if they attempt to chat via the RAT's built-in messaging module.",
    "Avoid accessing sensitive internal portals on the infected machine, as the keylogger captures all keystrokes to a local <code>.dat</code> file."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}