Group-IB Details KGB RAT, an NjRAT-Based Windows Trojan
Group-IB analyzed KGB RAT, an NjRAT-based Windows malware-as-a-service that steals credentials and remotely controls PCs.
Group-IB analyzed KGB RAT, a Windows remote-access trojan built on obfuscated NjRAT and sold as malware-as-a-service since late 2025. Help Net Security reports forum pricing from $150 a month to $800 a year and a $500 network-spreading add-on, figures absent from the other report. Both describe keylogging, Windows Credential Manager access, a ChromeUpdate scheduled task, and a copy named svchost.exe. One analysis also cites screenshots, hidden VNC, WMI queries, an ip-api.com lookup, Telegram Bot API infection notices, and direct C2 for remote control. The sources diverge on extras: Cyber Security News limits a crypto clipper to one sample and says Group-IB’s behavioral detection still caught obfuscated samples without confirming every Defender-bypass claim, while Help Net Security describes webcam and microphone spying, a clipper for BTC, ETH, and TRC-20 addresses, a ransomware module, harassment features, and an antivirus-disable claim.
- Group-IB analyzed KGB RAT, an obfuscated NjRAT-based Windows remote-access trojan sold as malware-as-a-service since late 2025.
- Help Net Security reports pricing from $150 a month to $800 a year and a $500 network-spreading add-on.
- A tested sample copied itself into a temporary folder as svchost.exe and persisted with a ChromeUpdate scheduled task.
- Shared capabilities include keylogging and reading Windows Credential Manager; reports also mention screenshots, clipboard monitoring, hidden VNC, webcam and microphone capture.
- One report says a crypto clipper was present in one sample; the other says it swaps BTC, ETH, and TRC-20 addresses.
- The sample queried WMI, looked up the victim IP via ip-api.com, sent infection notices through Telegram’s Bot API, and used direct C2 for remote control.
- Sellers advertise a crypter claimed to bypass Windows Defender, but Group-IB does not confirm every bypass claim and says behavioral detection still caught samples.
- Help Net Security additionally reports a ransomware module, harassment features, and a claim that the malware disables antivirus.
Coverage timelineoldest first · each row is one article
- · 1d agoKGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs
Cyber Security News· 50
Group-IB analyzed KGB RAT, a malware-as-a-service trojan based on NjRAT that steals credentials and controls PCs.
- · 1d agoKGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
Help Net Security· 62
Group-IB says KGB RAT, an NjRAT-based Windows trojan sold from $150 monthly, steals passwords, spies via webcam, and includes ransomware.