Security researchers have uncovered a new strain of remote access trojan (RAT) called KGB RAT that can spy on victims, steal credentials, and take full control of targeted Windows PCs. Designed as malware-as-a-service, the tool is marketed with claims of being “fully undetectable” by tools like Windows Defender—though experts warn those claims don’t hold true across all versions or machines.
What KGB RAT Is and How It Spreads
KGB RAT, first promoted on underground forums in late 2025 (though server infrastructure traces back to early 2022), allows operators to rent access rather than build malware from scratch. Buyers receive a payload builder supporting formats including EXE, BAT, HTA, and REG, along with regular updates to a so-called “crypter,” intended to obfuscate the malware in hopes of slipping past antivirus tools. The package comes packed with tools for file system access, remote desktop control (often hidden), webcam/microphone activation, password recovery, and managing multiple infected computers as though the tool were legitimate remote administration software.
Behavior, Evasion, and Key Features
Analysis shows KGB RAT builds on earlier malware—its core contains obfuscated bits of NjRAT code, wrapped in a commercial infrastructure. After infection, the malware copies itself into a temporary folder using the name svchost.exe, sets up a scheduled task named ChromeUpdate to ensure persistence across reboots, modifies registry and display settings related to system file visibility and security warnings, and probes the operating system using tools like Windows Management Instrumentation (WMI) to detect virtual machines and security software.
Functionality includes harvesting passwords from Windows Credential Manager, logging keystrokes, monitoring clipboards and screenshots, and offering a hidden VNC session for remote view/control that may not be apparent to the user. KGB RAT also monitors for public IP via a service like ip-api.com and sends infection alerts via Telegram Bot API. One version analyzed includes a crypto clipper: a tool that watches for copied cryptocurrency addresses and substitutes them with attacker-controlled ones.
Protection Measures and Detection Markers
Despite its stickers of stealth, not all samples evade detection. Sandboxed and behavior-based detections still flag anomalies: programs launching from temporary folders, odd scheduled tasks like “ChromeUpdate,” changes to registry settings, unexpected child processes, or outbound connections to C2 servers or Telegram by non-browser processes. These patterns offer clues that defenders and endpoint protection tools can use.
Indicators of compromise (IoCs) include IP addresses and ports for primary and secondary command-and-control servers, malware website domains, hash values (SHA-256), defanged to prevent accidental activation. Key markers also include the scheduled task “ChromeUpdate”, the masquerade using “svchost.exe” in temporary directory, and unusual use of domains like ip-api.com or Telegram Bot API.
When responding to suspected infections, isolating the device, retaining logs for analysis, and resetting compromised credentials are critical. Organizations should enforce strict software policies, monitor for new scheduled tasks from unpacked or temp-folder-based executables, and pay special attention to outbound traffic involving services rarely used by legitimate processes.
KGB RAT signals how attackers continue to refine classic malware for modern use—marrying proven techniques like code reuse (from NjRAT) with services (crypters, commercial payload builders), while leveraging popular platforms (Telegram) and trusted services (ip-api.com). The end result is a threat that’s not wholly novel, but increasingly dangerous and harder to spot.
What this means: The resurgence and evolution of RAT malware like KGB RAT highlight the persistent danger corporations and individuals face from even non-zero-day threats. The real shift isn’t in technique so much as in packaging, accessibility, and adaptive evasion. Watch for signs through network traffic, scheduled tasks, registry changes, and IP/port anomalies—effectiveness in defense increasingly depends on vigilance, behavior monitoring, and sticking to zero-trust principles.
