NinjaMalware
Ninja is a malware developed in C++ that has been used by ToddyCat to penetrate networks and control remote systems since at least 2020. Ninja is possibly part of a post exploitation toolkit exclusively used by ToddyCat and allows multiple operators to work simultaneously on the same machine.From MITRE ATT&CK
Last reported 9 days ago, by Risky Business News9 reports
ATT&CK techniques
6 of 47 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1055Process Injection
“* [Process Injection: Thread Execution Hijacking](hxxps://attack.mitre.org/techniques/T1055/003/)”
- T1105Ingress Tool Transfer
“T1105”
- T1176.001Browser Extensions
“A list of targeted browser extensions can be found here.”
- T1505.003Web Shell
“The zero-day has been used to plant web shells on Nextcloud servers where the app was installed since at least September.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Risky Bulletin: Russia arrests DataSuckers hacking group“New tool—Rikugan: Security firm Synacktiv has released Rikugan, a reverse-engineering agent for IDA Pro and Binary Ninja.”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“…), CVE-2026-85097 (Bricksforge WordPress plugin), CVE-2026-93836 (WPC Product Bundles for WooCommerce WordPress plugin), CVE-2026-94504 (Ninja Forms WordPress plugin), CVE-2026-105133, CVE-2026-105134 (AhsayCBS), CVE-2026-96940 (Microsoft Exchange Server), CVE-2026-63277 (LibreOf…”
-
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE“WPC Product Bundles for WooCommerce and Ninja Forms Flaws Exploited”
-
MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures“Raw Binary Ninja High-Level IL Decompilation (0x100001070 – 0x100001300)”
-
Insights into Suspected DPRK Workers“VDO Ninja: A free software designed to transmit audio and video as a device input to software such as OBS.”
-
Taking SHELLTER: a commercial evasion framework abused in-the-wild“IDA Pro or Binary Ninja can successfully decompile the code at this stage.”
-
Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns“Binary Ninja has a handy feature called [User-Informed Data Flow](hxxps://docs.binary.ninja/dev/uidf.html) (UIDF), which we can use to set the variables to known values to trigger a constant propagation analysis and simplify the expressions.”
-
Top 3 Cybersecurity Threats of 2024 (So Far)“Meanwhile, rogue installations of Ninja, Domotz, Auvik, Naverisk, and Kaseya VSA have also been reported as tools abused by attackers looking to cement their foothold in an environment.”
-
The Mechanics of Defense Evasion“I asked general awesome human being and Lead Product Owner, the Ninja Sharon Martin about the above:”
Indicators in its reports
named in the reports above- fbijobs[.]govin 1 report
- drivinguber[.]comin 1 report
- mictests[.]comin 1 report
- ip[.]mein 1 report
- webcammictest[.]comin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.