Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
Lab52 researchers analyzed infrastructure and associated malware samples indicating a long, ongoing njRAT campaign against the Middle East. The researchers’ analysis began with the domain they found being used for C2 in both a Vjw0rm and a njRAT sample. By pivoting off of the IP addresses tied to this domain, a series of suspicious, dynamic domains were discovered as being associated to one of the IPs. Using this IP address, further link analysis revealed a large number of malware samples, most of which were modified njRAT executables. Strings within the samples aligned with open source reporting related to njRAT. Once installed on a system, the njRAT can provide attackers with both keylogging functions and RAT capabilities, such as being able to download and execute additional binaries. Based on their findings, the researchers hypothesize that this campaign has been active for an extended period of time and the attackers have been constantly evolving their activities.
SHA256