KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs

A Windows remote access trojan called KGB RAT gives attackers a way to spy on infected computers, collect credentials and control a victim’s desktop.

The malware is sold as a service and advertised with a “fully undetectable” crypter that its sellers claim can bypass Windows Defender and other antivirus products.

That claim should be treated carefully: Group-IB’s report documents the advertised evasion and observed malicious behavior, but does not show that every version can reliably defeat Defender on every system.

Analysts and researchers from Group-IB identified and analyzed KGB RAT, finding a tool that combines credential theft, keylogging, remote control and ransomware features.

The researchers also found that its operators use a separate Telegram channel to receive infection alerts, while the malware contacts command-and-control (C2) servers for instructions.

KGB RAT Malware Bypasses Windows Defender

Group-IB said KGB RAT was promoted on underground forums from late 2025, but traces of an early version of its server infrastructure date to January 2022.

The malware is sold through a malware-as-a-service model, meaning buyers can rent access rather than build their own tool. The seller advertises daily crypter updates and a payload builder that can create files in formats including EXE, BAT, HTA and REG.

The product is presented as a legitimate remote administration tool. Its advertised features include file access, webcam and microphone control, password recovery, hidden desktop access and tools for managing multiple infected computers.

Group-IB’s analysis found samples based on an obfuscated version of NjRAT, a known remote access trojan. This connection matters because KGB RAT is not simply a new name: it builds on existing malware code and adds a commercial package around it.

The report also shows why a RAT can be dangerous even when it does not use a new technique. A related NjRAT campaign abusing Microsoft Dev Tunnels shows how familiar malware can use trusted online services to hide its network traffic. KGB RAT takes a different route, using Telegram for alerts and direct C2 connections for remote control.

In Group-IB’s tested sample, the original program copied itself into a temporary folder and relaunched as svchost.exe, a name that resembles a real Windows process.

It then created a scheduled task called ChromeUpdate to run again when a user signs in. The malware also changed a Windows setting that controls the display of hidden system files and modified a setting related to security-zone warnings.

The malware checks the computer before carrying out its work. Group-IB observed it querying Windows Management Instrumentation (WMI) for information about the operating system, running processes and installed security products.

It also checked for signs of virtual machines and analysis tools. These steps can help malware avoid running in a research sandbox or reveal which defenses are present.

How KGB RAT takes hold and stays active

For credential theft, researchers observed the sample accessing Windows Credential Manager files. These can hold saved sign-in details for websites, network resources and applications.

KGB RAT also includes a keylogger that can record keyboard activity, as well as features for screenshots, clipboard monitoring and remote desktop control.

Its hidden VNC feature is designed to give an operator a remote view or control session that may not be visible on the victim’s desktop. Readers can learn more about this method in Cybersecurity News’ article on hidden VNC remote desktop control.

Group-IB observed the malware looking up a victim’s public IP address through ip-api.com and sending an infection notification through Telegram’s Bot API.

The report also describes a Crypto Clipper feature in one analyzed sample. This type of tool watches copied cryptocurrency addresses and may replace them with an address controlled by the attacker.

KGB RAT’s sellers claim its crypter can bypass or disable Windows Defender. A crypter changes or wraps malware code to make it harder for antivirus products to recognize a file by its signature.

The seller’s claim is not proof that all builds evade protection. Group-IB says its own Malware Detonation Platform detected samples by observing their behavior, including after obfuscation or unpacking.

That distinction is useful for defenders: a file may change, but its actions can still raise alarms. In the analyzed sample, warning signs included a program running from a temporary folder, an unfamiliar ChromeUpdate task, registry changes, suspicious child processes and connections to Telegram or the listed C2 servers.

A Cybersecurity News report on Silver RAT antivirus bypass methods provides further context on how RAT sellers use crypters and other evasion claims.

Organizations should keep endpoint protection active and updated, restrict unapproved software, and alert on scheduled tasks created by programs running from user-writable folders.

Security teams should review unusual process chains and outbound connections, especially when Telegram or the listed geolocation service is contacted by a non-browser process.

If infection is suspected, isolate the device, preserve logs and investigate from a clean system before resetting exposed credentials and sessions.

Indicators of compromise (IoCs):-

Type	Indicator
Primary C2	104[.]248[.]130[.]195 — ports 7489, 7490, 7492
Secondary C2	2[.]59[.]134[.]215 — port 443
Geolocation service	ip-api[.]com/json/
Telegram notification	api[.]telegram[.]org/bot*/sendMessage
Malware website	kgbrat[.]org
Command delimiter	|Ghost|
Scheduled task	ChromeUpdate
Masquerade name	svchost.exe dropped in %TEMP%
SHA-256	559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36
SHA-256	581c440644f93a17191b98158c467be5ae5972ab19668c6e8530a2034833bd45
SHA-256	d4fc7867caf1349bbbfd1f2972fe92acedd8507ae89fa822c07f09a194127894
SHA-256	d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62
SHA-256	df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8
SHA-256	836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7
SHA-256	1b3c95cf2a030df15d1474af2ae96bfe9a6ed160319c1a8782237206035d82c7
SHA-256	d691e9721c38104777664f8afd3941ededcadd433b3b593de3e21aa14d60f1f2
SHA-256	22255c3c488d4c92ea3567d1032e7a7c790a22cde989a8f0eb257c2d6d811ed4
SHA-256	25eb0dfbe57dc07d461e62643262c45de052b012529ad05c7f19c5eb0c1ed646
SHA-256	8c3e8d0a5fadbd696bcbd56313d69d94f41f1b2678cfea4db83999a6ad62a63e
SHA-256	3d71f8b5171f2fe47d9a247a193c1b48c1aaa4d533811e208b8d94ffa5800c9e

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.