KGB RAT malware is a Windows remote access trojan designed to steal credentials and give criminals covert control of infected computers. Group-IB published a detailed technical analysis on 14 October 2026, exposing its capabilities, infrastructure and malware-as-a-service model.
KGB RAT malware analysis reveals a modular threat
Group-IB found that KGB RAT is sold as a subscription service rather than reserved for one identified criminal group. This model gives customers access to a builder, a crypter and modules supporting credential theft, keylogging, hidden desktop access, remote control and ransomware activity.
Independent coverage published on 15 October 2026 reported advertised subscriptions starting at 150 US dollars per month. The seller promotes the package as easy to operate, including claims that customers do not need to configure port forwarding. This lowers the practical barrier for less experienced criminals seeking an operational Windows trojan.
The malware is associated with the NjRAT code lineage and targets Microsoft Windows systems. Samples described in reporting include 32-bit .NET executables, often written in VB.NET. The builder can reportedly create several Windows payload formats, including EXE, BAT, HTA and REG files, giving operators options for different delivery campaigns.
No specific Windows edition or version has been identified as uniquely vulnerable. KGB RAT malware is not exploiting a disclosed CVE. It is an operational crimeware tool that must first be delivered and executed on a Windows device, potentially through phishing, malicious downloads or another access route selected by its customer.
Timeline of KGB RAT malware activity
Although the detailed vendor analysis is recent, evidence indicates that development and promotion began considerably earlier. Group-IB identified traces of server infrastructure labelled KGB RAT v0.1 dating to late January 2022, suggesting an early stage of the service was operating before it attracted wider attention.
- Late January 2022: Group-IB found traces of early server infrastructure labelled v0.1.
- 5 September 2025: The earliest located public alert mentioned K.G.B RAT being shared on a hacker forum.
- 3 December 2025: Multiple reports described underground advertising for K.G.B RAT, its crypter and hidden virtual network computing capability.
- Late 2025: Group-IB recorded active underground promotion of the service.
- 14 October 2026: Group-IB published its full technical analysis, including capabilities and indicators of compromise.
- 15 October 2026: Further coverage detailed indicative pricing and the seller’s antivirus bypass claims.
The underground offering was advertised as being updated daily and fully undetectable. Forum advertising supports the conclusion that the tool was available as commodity malware, but statements made by sellers should not be treated as independent proof of technical effectiveness.
How KGB RAT malware controls infected computers
Credential theft and keylogging
KGB RAT malware can target passwords held in browsers and Windows credential stores. Its keylogger can also record input as a user types, potentially capturing credentials, messages and other sensitive information that is not available from stored browser data.
This combination allows an operator to gather both existing credentials and newly entered information. Stolen accounts could then support further access to email, cloud services or business applications, depending on what the infected user can reach.
Hidden desktop access and remote tasking
The hidden virtual network computing module, commonly called HVNC, creates a concealed desktop session on the compromised host. An attacker can interact with this hidden environment while the user’s visible desktop appears unchanged, making hands-on activity less obvious to the person using the computer.
For tasking, the trojan connects to dedicated command-and-control servers. This channel can deliver instructions and support remote control. The malware separately uses Telegram channels or bots to notify operators about new infections, allowing a buyer to receive rapid alerts without continuously monitoring the main control panel.
Researchers also observed lookups to the public ip-api.com geolocation service. Such requests can help an operator identify the approximate location and network details of an infected system. Telegram Bot API traffic and geolocation lookups are behavioural clues, although either service can also have legitimate uses.
Ransomware and antivirus evasion claims
The package includes a ransomware module, meaning access established for surveillance or credential theft can potentially be turned into disruptive file encryption. Its breadth gives customers several monetisation options from the same infection.
The seller supplies what it describes as a fully undetectable crypter, with claims that it can bypass or disable Windows Defender and evade other antivirus tools. However, Group-IB documented the advertising and malicious behaviour, not a universal bypass across every Defender configuration and Windows environment.
It is therefore more accurate to describe Defender evasion as a seller claim. Crypters can change how malicious code is packaged to reduce static detection, and frequently updated samples may initially evade some controls, but that does not establish reliable or permanent invisibility.
Current exploitation status and indicators
KGB RAT malware is considered an in-the-wild commodity threat rather than a proof of concept. Underground sales, analysed samples and associated command-and-control infrastructure show that the service is operational. Public reporting does not name affected organisations, sectors or a single threat actor responsible for its use.
A third-party aggregation of indicators from the Group-IB research lists the domain kgbrat.org, the IP addresses 104.248.130.195 and 2.59.134.215, and twelve SHA-256 file hashes. Example hashes include d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62 and 559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36.
These indicators can assist investigation, but defenders should not block infrastructure without checking context and current ownership. Malware services can rotate domains, servers and payload hashes, so behavioural detection remains important.
Why KGB RAT malware matters to UK organisations
The subscription model packages several serious capabilities into a relatively accessible service. For UK small and medium-sized organisations, the principal concern is that commodity operators can purchase covert remote access and credential theft without developing their own malware.
Businesses relying only on default endpoint settings may also place too much confidence in the seller’s claimed detection status. A labelled fully undetectable payload can still produce detectable behaviours, including unusual script execution, credential access, Telegram connections and outbound command-and-control traffic.
Actions organisations should take now
- Add the published domain, IP addresses and file hashes to monitoring tools, while validating matches before containment.
- Review Microsoft Defender Attack Surface Reduction rules, including controls that block credential theft from LSASS, Office child processes and potentially obfuscated scripts. Test rules in audit mode before blocking.
- Monitor access to api.telegram.org where Telegram is not required, correlating connections with the originating process and its parent process.
- Hunt for unexpected .NET executables, BAT, HTA or REG payloads, particularly when launched from email, downloads or temporary directories.
- Investigate endpoints showing browser credential access, keylogging behaviour, hidden desktop activity or connections to unfamiliar external servers.
Because infrastructure and payloads can change, organisations should combine the KGB RAT malware indicators with endpoint telemetry and network behaviour. This provides a stronger basis for detecting both known samples and newly repackaged variants.
Originally reported by cybersecuritynews.com.
