{
  "family": "njrat",
  "sample_count": 19,
  "category": "rat",
  "description": "njRAT, also tracked as Bladabindi, is one of the most prolific commodity remote access trojans worldwide. First observed around 2012, it provides keylogging, webcam capture, microphone access, file management, remote shell, and credential theft. Its low cost and ease of use have made it extremely popular with low-skilled threat actors, particularly across the Middle East and North Africa. njRAT typically spreads through phishing, cracked software downloads, and USB infection.",
  "cta": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.",
  "aliases": [
    "bladabindi",
    "lv",
    "ratenjay"
  ],
  "enrichment_level": "hand-curated",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Njrat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "njRAT, also tracked as Bladabindi, is one of the most prolific commodity remote access trojans worldwide. First observed around 2012, it provides keylogging, webcam capture, microphone access, file management, remote shell, and credential theft. Its low cost and ease of use have made it extremely popular with low-skilled threat actors, particularly across the Middle East and North Africa. njRAT typically spreads through phishing, cracked software downloads, and USB infection."
      }
    },
    {
      "@type": "Question",
      "name": "How does Njrat spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "njRAT (Bladabindi) is distributed through cracked software, USB autorun shortcuts, and social-engineered downloads, popular among low-skill operators in Arabic-speaking regions."
      }
    },
    {
      "@type": "Question",
      "name": "What are the signs of a Njrat infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Webcam and keystroke logging indicators, hidden Run registry persistence, and antivirus detections for njRAT, Bladabindi, or Ratenjay are common signs."
      }
    },
    {
      "@type": "Question",
      "name": "What should I do if I think I have Njrat on my system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [
    "T1056.001",
    "T1547.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-05-27"
}