KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims

KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the screen. The malware, called KGB RAT, was analyzed by Group-IB malware analysts Alpomish Asadov and Razvan Raducu, who found that it is built on NjRAT, a well-known remote access trojan used by attackers of varying skill. KGB RAT first showed up in public security reporting in September 2025, when a breach alert flagged it as a newly observed threat. It received wider attention in late 2025, around the time it started being promoted on hacking forums. The researchers also found a public disclosure from late January 2022 referencing a KGB RAT server at version 0.1, which they say indicates the developer had been building and testing the tool for years before bringing it to market. “The website markets KGB RAT as an advanced Windows administration tool, leading with headline claims of complete Windows control, military-grade encryption, 100% Fully Undetectable (FUD) technology, advanced monitoring, Telegram alerts, and daily updates. Beneath that marketing veneer, however, the advertised feature set reads as a fairly complete surveillance and control toolkit,” Group-IB explained. The KGB RAT developers went to great lengths to present the tool as legitimate software, Group-IB says. The website displays fake customer reviews, claims the software is used by more than 10,000 IT professionals, and offers videos showing how to install, configure and use it. “There’s even an entire legal section with disclaimers,” Group-IB noted, adding that the warnings and notifications in that section encourage buyers to use the software lawfully. The forum ads promoting the tool were more direct, with one telling buyers that “you can hack anyone Windows easily by using this RAT.” Those ads focused on two selling points. One is the claim that the tool can get past and permanently disable Windows Defender and other antivirus products, and the other is that it works without port forwarding, which makes it easier to use for less experienced attackers. Pricing Subscriptions start at $150 for one month and go up to $800 for one year, with lower prices for renewals. The cheapest package includes remote desktop access, file management, camera and microphone access, keylogging, password theft, persistence and anti-detection features. The more expensive plans add the ability to manage several infected computers at once, payload customization, extra evasion features, plugin support and access to more servers. The sellers offer a separate $500 “Network Spreading” add-on and claim it automates the spread of the malware inside a compromised network. KGB RAT also comes with ransomware, which in Group-IB’s view lets attackers go from getting into a computer to extortion without installing anything else. “The pricing gives an idea of how low the entry barrier can be.” Saved passwords and crypto payments at risk The advertised list includes a hidden remote desktop session the victim never sees, along with control of the victim’s screen, mouse and keyboard. In Group-IB’s testing, the trojan logged keystrokes and accessed Windows Credential Manager, which stores login details for websites, network resources and Windows applications. The developers advertise the ability to steal passwords saved by browsers and other software. Keylogging was switched on in every sample examined. On its first contact with the command server, the malware sends the computer’s name, the username, the date, the Windows version, whether the user has administrator rights and which antivirus product is installed. It also queries an IP geolocation service to get the victim’s public IP address, country, region, city, internet provider and approximate coordinates, and can send the victim’s IP address and location information to a Telegram bot, notifying the operator when a new victim connects. Another module watches the clipboard for cryptocurrency wallet addresses and swaps them for addresses the attacker controls, so the victim’s payments end up in the wrong wallet. “Only one sample has the CryptoClipper module enabled, with three hardcoded wallet addresses for BTC, ETH, and TRC-20 (Tron). This makes it the most financially motivated sample in the set and likely targets a different victim profile.” Fun settings Under a menu labeled “Extra,” the developers include what they call “fun settings,” letting the operator play scream sounds, show jump scares and force the computer to crash. Screenshot of “Fun” settings (Source:Group-IB) “The harassment and psychological distress features — screamer functions, forced blue screens, and what the developers label ‘fun settings’ — are less common in RAT tooling at this capability level,” Group-IB stated. Their inclusion suggests a developer community made up of both financially motivated cybercriminals and less sophisticated actors driven by disruption or the wish to intimidate victims, and widens the pool of potential operators. Hiding behind familiar names In testing, the trojan copied itself into the temporary folder under the name svchost.exe, borrowing the name of a standard Windows process, and ran from there. It created a scheduled task named ChromeUpdate, made to look like a Google Chrome update, which launches it at every login with the highest available privileges. The malware changed Windows settings to hide protected system files from view and to skip the security checks Windows performs when launching programs. On first run, it can display a fake error message claiming that files are missing or corrupted, to make the user think something went wrong. The message does not appear on later runs. The trojan tries to avoid being studied by security researchers. One of the analyzed samples stopped running when the computer’s motherboard model matched a name on a built-in list that included “Sandbox,” “Test” and “Virtual Machine.” Code in one sample checks for tools used to inspect malware, such as Wireshark, Process Explorer and dnSpy, and tries to stop the trojan if any of them are running. During testing, part of the malware paused for 600 seconds, which Group-IB says is long enough to outlast most automated analysis systems, since those usually run for 60 to 300 seconds. “KGB RAT illustrates how established malware remains operationally relevant through accessible packaging and continued maintenance,” Group-IB said. “The broader concern is the availability of a maintained attack tool that transfers much of the development burden from the operator to the supplier. Each customer can put familiar capabilities into use against a different set of victims, extending the reach of an otherwise unremarkable malware family,” researchers concluded.