KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
Group-IB says KGB RAT, an NjRAT-based Windows trojan sold from $150 monthly, steals passwords, spies via webcam, and includes ransomware.
62
Product
Windows Defender
- Mentions · 7d0
- Mentions · 30d2
- All mentions9
- First seenAug 17, 2026
- Last mentioned15d ago
Timeline
9 articles · newest firstKGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs
Group-IB analyzed KGB RAT, a malware-as-a-service trojan based on NjRAT that steals credentials and controls PCs.
50
Kothamine malware uses Tailscale’s tailcat to evade network detection
Malwarebytes details Kothamine, a Windows RAT spread via npm that tunnels commands through Tailscale tailcat.
67
Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
Nightmare Eclipse released a new Windows Defender PoC exploit called BigDiskBuster to prevent Defender from completing platform and signature updates.
70
Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit
A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.
55
Best Practices for Good Endpoint Hardening | Huntress
Huntress outlines endpoint hardening best practices, citing exposed RDP, RMM tool abuse, and ClickFix social engineering as common SMB intrusion paths.
20
Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly
US prosecutors charged Indian national Jay Goswami as a money mule who collected $7.5 million from nine elderly scam victims, now facing extradition from Canada.
30
Cybercriminals Turn GTA VI Leaks Into Malware Bait
Attackers spread fake 113GB GTA VI builds whose 50KB payload whitelists the entire C: drive in Windows Defender, alongside credential phishing and infostealer campaigns.
30
Threat Brief: Ongoing Russia and Ukraine Cyber Activity
Ukrainian government sites were defaced via OctoberCMS CVE-2021-32648 while Microsoft-attributed actor DEV-0586 deployed destructive WhisperGate malware.
78
Related CVEs
by mentions- CVE-2021-3264890%9.1Authentication Bypass in October CMS Password Reset Enables Account Takeover
Appears with
- Microsoftvendor · 6
- NjRATmalware · 2
- Rockstar Gamesvendor · 2
- Kasperskyvendor · 2
- Group-IBorganization · 2
- KGB RATmalware · 2
- Windowsproduct · 2
- Grand Theft Auto VIproduct · 2
- Microsoftorganization · 2
- Windows Credential Managerproduct · 2
- Palo Alto Networksvendor · 1
- Ukrainian governmentvictim · 1
- SecurityAffairsvendor · 1
- IGNvendor · 1
- Kothaminemalware · 1
- CyberLeekthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.