Malware

NjRAT

Also known as: Bladabindi · Lime-Worm

RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives." It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.

Indicators of Compromise 7

Domain 6789x[.]site Domain cel-robox[.]com Domain healthymagination[.]com Domain krogeralbertsons[.]com Domain maxfactor-international[.]com Domain rezilion[.]com Domain snsystems[.]com

MITRE ATT&CK TTPs 8

Command And Control

Command And Control

Ingress Tool Transfer

Command And Control

Exploit Public-Facing Application

Lateral Tool Transfer

Lateral Movement

Acquire Infrastructure

Resource Development

Compromise Infrastructure

Resource Development

Source Articles

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actor Sable Squirrel has spent nearly $7 million acquiring expired domains to exploit their inherited reputation, traffic, and backlinks for illegal sports streaming, online gambling promotion, and malware distribution. The group operates a dual-purpose infrastructure where re-registered domains serve both as streaming platforms and command-and-control (C2) servers for malware such as Quasar RAT and HiddenTear ransomware. The operation targets users in Asia and Australia through social media and ad networks, using a traffic distribution system to redirect victims while evading detection. Additional scavenger actors like Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel are also abusing expired domains for ad fraud, tech support scams, and traffic resale.

hacker-news ·2d ago