Loading story…
Researchers identified two active remote access trojan operations built on commodity malware families, with one involving a customized QuasarRAT variant dubbed DollRAT or "Lilly's RAT V8" and the other using njRAT v0.7d (Bladabindi). DollRAT was observed using a modified QuasarRAT v1.4.1 codebase with ConfuserEx obfuscation, runtime string decryption, and command-and-control traffic routed through an ngrok TCP tunnel at 0.tcp.eu.ngrok.io:18107, backed by AWS infrastructure in Frankfurt. The malware supports credential theft from browsers and FTP clients, keylogging with HTML-formatted logs, system reconnaissance, remote shell access, file management, remote desktop, registry changes, reverse proxying, and persistence through Run keys and scheduled tasks. Embedded branding including "Lilly's RAT V8" and "C.U.M Software Inc." suggests an actively maintained custom build rather than an unmodified public RAT.
A separate analysis tracked an njRAT sample named Client.exe to a broader campaign using the hardcoded No-IP hostname njspider.myddns.me on TCP port 4444, resolving to Belgian residential IP 62.235.6.231. That operation has reportedly been active since at least late 2025, with multiple related binaries and rapid rebuilds sharing the same infrastructure. The njRAT sample retained standard capabilities including persistence via HKCU Run keys, keylogging, screenshots, webcam capture, remote shell, file transfer, plugin execution, USB spreading, and plaintext TCP beaconing. Across both cases, operators relied on legitimate services such as ngrok, No-IP, ipwho.is, and api.ipify.org to mask or support C2 activity, while the tooling and infrastructure pointed to low-sophistication but active commodity malware operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Breakglass first observed DollRAT on 2026-03-14 and assessed it as a newly seen custom QuasarRAT v1.4.1 variant branded as "Lilly's RAT V8." The malware used ConfuserEx obfuscation, runtime string decryption, and an active ngrok TCP tunnel for command-and-control.
The analyzed njRAT sample was observed on VirusTotal about three minutes after compilation, suggesting active distribution or testing on 2026-03-12. The sample resolved its C2 hostname to Belgian residential Proximus IP 62.235.6.231.
On 2026-03-12, the operator rapidly rebuilt multiple njRAT samples tied to the same No-IP DDNS infrastructure. One analyzed VB.NET sample, Client.exe, was compiled that day and configured to use njspider.myddns.me over TCP port 4444.
A broader njRAT v0.7d (Bladabindi) campaign using the hostname njspider.myddns.me was active since at least December 2025. Breakglass linked at least eight binaries to the same infrastructure, indicating an ongoing commodity RAT operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented continued use of **njRAT** (also known as **Bladabindi**) in targeted intrusion campaigns alongside other commodity and custom remote access trojans. Cisco Talos said the **SideCopy** APT, which targets government personnel and other entities in India, incorporated njRAT into multi-stage infection chains that often begin with malicious `.LNK` files and progress through HTAs and loader DLLs before deploying RATs and post-compromise plugins for credential theft, file enumeration, and keylogging. ESET separately reported **Operation Spalax**, a phishing-driven campaign aimed at Colombian government institutions and private-sector organizations, especially in the energy and metallurgical sectors, where attackers used shortened links, RAR archives, and multiple droppers to install njRAT, **Remcos**, and **AsyncRAT** for surveillance and remote control. A technical analysis of an **njRAT 0.6.4** sample tied to the campaign ID `splitgateukrayna` showed how the malware persists by copying itself to `%AppData%\services64.exe`, creating a Run registry key, adding a Windows Firewall exception, and using the mutex `49e91d08e684b1770e0cefa60401157a`. The sample connected to `44gang44.duckdns[.]org` on port `2222`, profiled infected systems, and supported a broad set of capabilities including hidden shell execution, keylogging, screenshot capture, registry manipulation, plugin loading, payload download-and-execute, self-update, and uninstall. Across the reported campaigns, njRAT remained a flexible, low-cost espionage tool used to establish persistence, collect victim data, and enable long-term remote access.
Aug 15, 2026
Researchers across multiple reports documented continued **njRAT** (also known as **Bladabindi**) activity delivered through diverse infection chains, including malicious PowerPoint macros, phishing attachments, password-protected archives, trojanized software on Korean webhard sites, compiled AutoHotKey loaders, and typosquatted npm packages. The malware was shown using layered obfuscation in VBS and PowerShell, Base64-encoded payloads, reflective or in-memory loading, and staged retrieval from services such as `paste.ee`, `archive.org`, `wtools.io`, and dynamic DNS infrastructure. In one supply-chain case, the npm packages `jdb.js` and `db-json.js` installed a .NET payload that copied itself as `dchps.exe` and connected to `46.185.116.2:5552`, while other campaigns used domains including `fidapeste2.duckdns.org`, `xxxcarldon.duckdns.org`, and `0.tcp.eu.ngrck.io` for command and control. Analysis of multiple samples showed njRAT maintaining persistence through **Startup folder** copies, **registry Run keys**, shortcuts, mutexes, firewall-rule changes, and even `netsh` exclusions, while some variants bundled legitimate applications so victims would not notice the infection. Once active, the RAT collected host profiling data and supported a broad set of attacker functions, including **keylogging, credential theft, webcam access, screenshot and screen viewing, file transfer, process and registry manipulation, remote shell access, and full remote control** of Windows systems. Reports also linked njRAT delivery to long-running loader ecosystems that rotated payload families such as Houdini, LimeRAT, RevengeRAT, AsyncRAT, and VjW0rm, underscoring the malware’s persistence as a flexible commodity RAT used across phishing, malware-hosting, and software supply-chain abuse.
Aug 15, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026