AsyncRAT, Remcos and njRAT Commodity RATs Guide: How defenders detect and contain them

AsyncRAT, Remcos and njRAT keep turning up in phishing campaigns because they are cheap, widely available and good enough to hand an attacker full control of a Windows desktop. Because anyone can obtain them, the family name tells you very little about who is behind an intrusion, but a lot about what the operator can do next. This profile covers where each family came from, which tracked groups use them, the ATT&CK techniques defenders see, how they feed credential theft, the public disruptions and campaigns, and the behaviour-level detections and controls that catch all three. It is written for SOC analysts, incident responders and email and endpoint engineers. It is strictly defensive and contains no builder, configuration or payload detail. For the general RAT concept, read the Remote Access Trojans (RATs) Guide first; this page goes deeper on these three families.

Key takeaways

• Three families, three supply models. MITRE ATT&CK describes AsyncRAT (S1087) as open source code originally published on GitHub, Remcos (S0332) as closed source software sold by a company as remote control and surveillance software, and njRAT (S0385) as a RAT first observed in 2012.
• Attribution from the family alone is unsafe. ATT&CK links the same families to cybercrime groups such as TA2541 and to espionage groups such as Gamaredon Group and Transparent Tribe, so treat the RAT as a capability and attribute on infrastructure, targeting and tradecraft.
• The delivery chain is where you win. Script files and macro documents arriving by email or cloud storage links, then PowerShell fetching the next stage, are the common path. Blocking script and macro execution from user download locations stops most of it before the RAT runs.
• Every infection is a credential incident. All three log keystrokes (T1056.001) and njRAT steals browser credentials (T1555.003), so rebuilding the host without resetting passwords and revoking sessions leaves the attacker a route back in.
• Persistent connections are easy to spot. Long-lived outbound sessions from user-writable folders to dynamic DNS names or non-standard ports (T1568, T1571) are a stronger signal than any single hash.

Who they are (names and aliases)

These are malware families, not threat groups. The table summarises what MITRE ATT&CK v20 records about each, which is the most stable public baseline.

Antivirus vendors use their own names (Bladabindi is Microsoft's name for njRAT, for example), so map detections to the ATT&CK software entry before you count incidents. Loaders and crypters wrap all three: ATT&CK records Snip3 (S1086) as a crypter-as-a-service used since at least 2021 to load AsyncRAT, Revenge RAT, Agent Tesla and NETWIRE. See the Malware Loaders and Droppers Guide.

Targeting and motivation

Commodity RATs serve whoever buys or downloads them, so targeting follows the operator, not the tool.

• Cybercrime against specific sectors: Proofpoint describes TA2541 as a cybercrime actor active since January 2017 that sends commodity RATs, with AsyncRAT its current favourite, to aviation, aerospace, transportation, manufacturing and defence organisations, using flight, charter and fuel themed lures. Cisco Talos tracked a related aviation-themed operation (Operation Layover) using AsyncRAT and njRAT, aimed at the aviation industry since at least 2018.
• Regional espionage and fraud: ATT&CK describes APT-C-36 (Blind Eagle) as a suspected South American group engaged in espionage and financially motivated operations since at least 2018 against government, financial, energy and manufacturing targets in Colombia and Latin America, and lists all three families among its tools. See the Blind Eagle Threat Actor Profile Guide.
• State-linked espionage on a budget: Gamaredon Group (a suspected Russian group targeting Ukraine since at least 2013) is linked to Remcos, and Transparent Tribe (a suspected Pakistan-based group targeting India and Afghanistan) to njRAT. Cheap tools give these groups deniability and save custom development.
• Opportunistic and low-skill actors: free or cracked builders mean small fraud crews and individuals use the same families against consumers and small businesses.

For defenders, the practical consequence is that a Remcos alert at a defence supplier and one at a retail branch can come from very different adversaries. Triage on what happened before and after the RAT, not on the label.

Tactics and techniques (MITRE ATT&CK)

The mapping below uses technique IDs that ATT&CK v20 associates with these families (verified against the v20 dataset). It is grouped by what the defender can act on.

For channel analysis in depth, see the Beaconing and C2 Detection Guide.

How they abuse identities and credentials

The RAT is rarely the end goal. It is the collection point for identity material that is then used elsewhere.

• Typed secrets: keylogging captures passwords, one-time codes and recovery answers as the user types them, which defeats any MFA based on codes the user enters.
• Stored secrets: browser password stores and saved sessions on the device are read directly (T1555.003). A session cookie issued after MFA can be replayed until it is revoked. See the Token and Session Security Guide.
• Non-human credentials on the desktop: developer and administrator workstations hold SSH keys, cloud CLI profiles, API keys in configuration files and password manager exports. A RAT with file access (T1005 in njRAT's mapping) can collect them, and these secrets often have no MFA and long lifetimes. See the Infostealer Threat Guide for the same risk from stealers.
• Live session hijack: with remote desktop control the operator can act inside an already signed-in banking, ERP or admin portal session, so the activity appears to come from the legitimate user on a trusted device.
• Follow-on access: harvested credentials are reused against VPN, email and cloud consoles as valid accounts (T1078). The Snowflake breach shows how credentials harvested from infected endpoints, never rotated, were later replayed against accounts without MFA.

Notable incidents

• 2014 njRAT and Njw0rm disruption: Microsoft's Digital Crimes Unit obtained a temporary restraining order from a US federal court in Nevada in June 2014 that made Microsoft the DNS authority for 23 free dynamic DNS domains, so it could sinkhole traffic from Bladabindi (njRAT) and Jenxcus (Njw0rm). Microsoft said that provider's domains were used in 93% of those infections and reported more than 7.4 million detections in the previous 12 months. The case was later settled with the dynamic DNS provider. The lesson for defenders is lasting: free dynamic DNS remains a favourite C2 resolver for commodity RATs.
• 2017 onwards, TA2541 aviation campaigns: Proofpoint documented high-volume campaigns (typically hundreds to thousands of messages, nearly always in English) linking to Google Drive hosted VBS files that use PowerShell to fetch the RAT from paste and code hosting sites, with Discord CDN links seen from late 2021.
• 2021 Operation Layover: Cisco Talos reported PDF lures linking to VBS crypters on Google Drive that delivered AsyncRAT, and Publisher macro documents that led to njRAT, aimed at aviation organisations.
• Latin American campaigns: ATT&CK records Operation Spalax and APT-C-36 activity using Remcos and njRAT against Colombian targets.

Use these as patterns rather than indicator lists. Published hashes and domains age within weeks; the delivery chain and the post-infection behaviour do not.

Detection and defence

Behaviour-level detections

Preventive controls

1. Block macros and scripts at the front door: block macros in files from the internet and stop double-click execution of .vbs, .js, .hta and .wsf files for standard users. See the Office Macro Blocking Guide.
2. Enable attack surface reduction style rules: on Microsoft Defender for Endpoint, rules such as "Block all Office applications from creating child processes", "Block execution of potentially obfuscated scripts", "Block JavaScript or VBScript from launching downloaded executable content" and "Block executable content from email client and webmail" target this chain (ATT&CK M1040 Behavior Prevention on Endpoint). Run them in audit mode for two to four weeks, review the hits, add exclusions, then switch to block by pilot ring; roll back a rule to audit if it breaks a business process.
3. Application control for user-writable paths: deny execution from AppData, Temp and Downloads where business allows (NIST CSF 2.0 PR.PS-05). See the Macro Malware Guide for the document side.
4. Filter email and links: detonate attachments and archives, rewrite links to cloud storage and CDNs, and quarantine script attachments outright. See the Email Security Guide.
5. Restrict dynamic DNS and non-standard egress: block or alert on dynamic DNS categories and outbound TCP from workstations to ports other than those your proxy allows (ATT&CK M1031 Network Intrusion Prevention; NIST SP 800-53 SC-7).
6. Disable removable media autorun and control USB: reduces njRAT spread through T1091.

Response essentials

• Contain: isolate the host through EDR, preserve memory and the persistence artefacts, and identify the delivery message to purge it from other mailboxes.
• Reset and revoke: reset every password typed or stored on the host, revoke sign-in sessions and refresh tokens, and rotate SSH keys, API keys and cloud CLI credentials found on it. See the Identity Incident Response Playbook.
• Rebuild: reimage rather than clean, because the operator may have pulled down further tools (T1105).
• Scope: search for the same parent chain, persistence path and C2 domain across the estate before declaring a single-host incident.

Metrics

• Pre-execution block rate: share of RAT detections stopped at email, macro or script controls rather than after execution.
• Mean time to isolate: from first EDR alert to host isolation, target under 30 minutes.
• Credential reset completion: share of confirmed infections where all passwords, sessions and machine secrets on the host were rotated within 24 hours.
• ASR rule coverage: percentage of Windows endpoints with the script and Office rules in block mode.
• Dynamic DNS exposure: number of workstations resolving dynamic DNS names per week, trending down.

Framework mapping

See the CIS Control 10 Malware Defenses Guide for the control in depth.

Practitioner checklist

• Map your antivirus and EDR detection names for AsyncRAT, Remcos and njRAT to ATT&CK S1087, S0332 and S0385 so incidents are counted consistently.
• Block internet-sourced macros and stop standard users double-clicking script files.
• Deploy the Office and script ASR style rules in audit, review, then block by ring.
• Alert on script hosts spawning PowerShell and on new Run keys or scheduled tasks pointing to user folders.
• Alert on or block dynamic DNS resolution and non-standard outbound ports from workstations.
• Write the response runbook so every RAT infection triggers password resets, session revocation and machine secret rotation.
• Remove long-lived cloud and SSH credentials from user desktops in favour of short-lived, brokered access.
• Attribute on infrastructure and targeting, never on the family name alone, and record the delivery chain in each case.

Standards and references

• MITRE ATT&CK: AsyncRAT (S1087)
• MITRE ATT&CK: Remcos (S0332)
• MITRE ATT&CK: njRAT (S0385)
• Microsoft Learn: Attack surface reduction rules reference
• Proofpoint: Charting TA2541's Flight
• Cisco Talos: Operation Layover
• Microsoft: Microsoft takes on global cybercrime epidemic in tenth malware disruption
• Fortinet: Remcos, a new RAT in the wild

Related NHI Mgmt Group resources: Remote Access Trojans (RATs) Guide · Agent Tesla and Formbook Guide · Malware Loaders and Droppers Guide · Infostealer Threat Guide · Identity Incident Response Playbook