Lab52 researchers analyzed infrastructure and associated malware samples indicating a long, ongoing njRAT campaign against the Middle East. The researchers’ analysis began with the domain they found being used for C2 in both a Vjw0rm and a njRAT sample. By pivoting off of the IP addresses tied to this domain, a series of suspicious, dynamic domains were discovered as being associated to one of the IPs. Using this IP address, further link analysis revealed a large number of malware samples, most of which were modified njRAT executables. Strings within the samples aligned with open source reporting related to njRAT. Once installed on a system, the njRAT can provide attackers with both keylogging functions and RAT capabilities, such as being able to download and execute additional binaries. Based on their findings, the researchers hypothesize that this campaign has been active for an extended period of time and the attackers have been constantly evolving their activities.