njRAT
Software · ATTACK:enterprise:S0385
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0385",
"title": "njRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0385",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--d906e6f7-434c-44c0-b51a-ed50af8f7945",
"external_id": "S0385",
"domain": "enterprise",
"created": "2019-06-04T17:52:28.806Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "1.7",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "LV"
},
{
"source_name": "Bladabindi"
},
{
"source_name": "FireEye Njw0rm Aug 2013",
"url": "https://web.archive.org/web/20200302085808/https://www.fireeye.com/blog/threat-research/2013/08/njw0rm-brother-from-the-same-mother.html"
},
{
"source_name": "Fidelis njRAT June 2013",
"url": "https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"
},
{
"source_name": "Trend Micro njRAT 2018",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"
},
{
"source_name": "Njw0rm"
}
]
}Explicit source assertions (40)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--005cbf7d-9d0b-443b-91db-7b148a1eb55b
Fidelis njRAT June 2013ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00c26d3c-72ba-4197-acd1-690691d452aa
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07773227-54d9-4476-877a-739c490b7b65
Fidelis njRAT June 2013 · Trend Micro njRAT 2018 · Citizen Lab Group5ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14a2bfd9-8be1-47f9-bced-b05ba2179eb5
Fidelis njRAT June 2013ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--168ab4a2-db4d-4d64-9951-6547145aabe6
Fidelis njRAT June 2013 · Kaspersky BlindEagle AUG 2024 · Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1daaea6e-527f-4c3d-9387-72ea68d7140d
Fidelis njRAT June 2013ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bc482f0-f5ee-433c-81bd-566ef8a8d7a6
Trend Micro njRAT 2018ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ca333e2-c94f-4cc1-af46-beae48ff3c43
Proofpoint Operation Transparent Tribe March 2016ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30180ece-4504-4b6a-9182-5a2fbe3292df
Fidelis njRAT June 2013 · Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30be2552-9794-4eef-b3b6-fa663f68784b
Fidelis njRAT June 2013 · Citizen Lab Group5ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36cdeef3-a216-44cd-ad79-dd8085e86fc3
Kaspersky BlindEagle AUG 2024 · Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48879c97-651c-4426-9093-bd8c4939fc19
Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b314d34-1e53-46a4-a3b8-131a19b256d6
Fidelis njRAT June 2013ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c7803e9-e099-4905-b32e-d46a09247e94
Fidelis njRAT June 2013 · Trend Micro njRAT 2018ATTACK:enterprise:G0043 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--516fa29b-1a88-451c-a3ff-96af653b94ab
Citizen Lab Group5ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6809f70c-63a2-415d-8c64-66784fd80caf
Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72a10804-bc08-47a8-92ec-8e173b30705e
Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ac39d41-f859-447e-947b-5da935d30894
Fidelis njRAT June 2013ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1027.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b17c352-f0b7-453d-9f80-e40b262ab8c7
Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8131a5ed-f95f-406d-ae56-e5e10c8ced74
Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--815fff92-274f-467c-a8c0-a623588c6739
Fidelis njRAT June 2013 · Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8519b4c1-55c5-46be-8bdb-aa2a6ee2cb1a
Fidelis njRAT June 2013ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85482d65-d2ac-4d79-8ee4-da653e73aa8f
Fidelis njRAT June 2013 · Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89698142-6c48-465f-9e61-0146d0fa481a
Fidelis njRAT June 2013 · Kaspersky BlindEagle AUG 2024ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93b303a6-3529-4cbd-941f-4dc71b8e73d8
ESET Operation Spalax Jan 2021ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c0bf8de-7366-46a4-a1b9-b6a72937c8db
CrowdStrike AQUATIC PANDA December 2021ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e300a25-28f0-4373-939c-16d4d27577af
Fidelis njRAT June 2013 · Kaspersky BlindEagle AUG 2024 · Trend Micro njRAT 2018 · Citizen Lab Group5ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0188e1f-8048-4ade-a1f5-9a56d2fcc2b1
Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1686.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab464bce-f384-45df-b2b8-7db2be236aa5
Fidelis njRAT June 2013 · Trend Micro njRAT 2018ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac612e35-03c6-4b14-9348-dea8119c593a
FireEye APT41 Aug 2019ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1070.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aeb4ffa0-24f7-4812-aa4d-553ac5e954de
Trend Micro njRAT 2018ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b036723f-a215-4c04-a625-e57faac4d6b9
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2cf7d18-daa0-45a1-b2c1-6b6056bb19c4
Fidelis njRAT June 2013 · Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5f8197f-d703-461a-ba51-6e7749dd8367
Kaspersky BlindEagle AUG 2024 · Trend Micro njRAT 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3dd85c9-407c-4718-ba17-3c377c544dde
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d46078a7-420b-4074-8ecb-3440737c12e4
Trend Micro njRAT 2018ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1568.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1bf83d4-90ce-4773-9b44-340c69e17de8
Trend Micro njRAT 2018ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:S0385
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f528d6d4-7118-48f4-a875-310a2f511900
Proofpoint TA2541 February 2022 · Cisco Operation Layover September 2021ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fada4b53-8916-406b-b042-bbf4185fe0d3
Fidelis njRAT June 2013ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fdaeae13-b9f2-4ae5-b4ae-c74fde73adcd
Fidelis njRAT June 2013