KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs
A new remote access trojan, KGB RAT, is being sold as a service with claims of bypassing Windows Defender, enabling credential theft, keylogging, and remote PC control.
A Windows remote access trojan (RAT) dubbed KGB RAT is being marketed on underground forums, promising attackers the ability to spy on infected computers, steal credentials, and gain full remote control over a victim's desktop. Advertised with a "fully undetectable" crypter, its sellers claim it can bypass Windows Defender and other antivirus solutions. While these claims should be approached with caution, analysis by Group-IB confirms the malware's capabilities, which include credential theft, keylogging, remote control, and ransomware features. Operators of KGB RAT utilize a dedicated Telegram channel for receiving infection alerts and establish direct command-and-control (C2) connections for instructions.
Group-IB's research indicates that KGB RAT has been promoted since late 2025, with earlier traces of its server infrastructure dating back to January 2022. The malware operates on a malware-as-a-service (MaaS) model, allowing buyers to rent access rather than develop their own tools. The seller reportedly offers daily crypter updates and a payload builder capable of generating files in various formats, including EXE, BAT, HTA, and REG. The product is deceptively presented as a legitimate remote administration tool, boasting features such as file access, webcam and microphone control, password recovery, hidden desktop access, and multi-PC management.
Group-IB's analysis revealed that the samples are based on an obfuscated version of NjRAT, a well-known RAT. This lineage is significant, as KGB RAT leverages existing malware code and packages it into a commercial offering. The report highlights how established malware can remain a potent threat by adopting new distribution or evasion tactics. For instance, a related NjRAT campaign was observed abusing Microsoft Dev Tunnels to conceal its network traffic, demonstrating how familiar threats can exploit trusted services.
KGB RAT employs several techniques to establish persistence and evade detection. In one analyzed sample, the malware copied itself to a temporary folder and relaunched as svchost.exe, a name commonly associated with legitimate Windows processes. It then created a scheduled task named ChromeUpdate to ensure it restarts upon user login. Furthermore, the malware modified Windows settings to display hidden system files and altered security-zone warning configurations. Before executing its malicious payload, KGB RAT queries Windows Management Instrumentation (WMI) for system information, including the operating system, running processes, and installed security products. It also checks for the presence of virtual machines and analysis tools to avoid sandboxed environments.
For credential theft, the analyzed sample accessed Windows Credential Manager files, which store saved login details for websites, network resources, and applications. KGB RAT also incorporates a keylogger to record keyboard input, along with features for capturing screenshots, monitoring the clipboard, and enabling remote desktop control through a hidden VNC feature. This hidden VNC capability allows an operator to view or control the victim's desktop without the user necessarily being aware of an active session.
Group-IB observed the malware identifying a victim's public IP address via ip-api.com and sending an infection notification to operators through Telegram's Bot API. One analyzed sample also included a Crypto Clipper feature, which monitors copied cryptocurrency addresses and can replace them with an attacker-controlled address, a common tactic in cryptocurrency theft. The sellers' claims of bypassing Windows Defender via their crypter are a key selling point. A crypter works by altering or wrapping malware code to obscure its signature, making it harder for antivirus software to detect. However, Group-IB's Malware Detonation Platform successfully detected samples by analyzing their behavior, even after obfuscation or unpacking, underscoring that while files may change, their actions can still be indicative of malicious intent.
Indicators of compromise (IoCs) associated with KGB RAT include specific C2 server IP addresses (104[.]248[.]130[.]195 on ports 7489, 7490, 7492, and 2[.]59[.]134[.]215 on port 443), the use of ip-api.com for geolocation, and Telegram's Bot API for notifications. Other indicators include the malware website kgbrat[.]org, the command delimiter |Ghost, the scheduled task ChromeUpdate, the masqueraded process name svchost.exe dropped in %TEMP%, and specific SHA-256 hashes. Organizations are advised to maintain updated endpoint protection, restrict unauthorized software, and monitor for unusual scheduled tasks originating from user-writable folders. Reviewing suspicious process chains and outbound connections, especially to Telegram or geolocation services from non-browser processes, is also crucial. In case of suspected infection, isolating the device, preserving logs, and investigating from a clean system before resetting credentials are recommended steps.
The KGB RAT malware, built upon the NjRAT framework, is being marketed on hacking forums for as little as $150 per month. Beyond its core remote access capabilities, the trojan includes features designed to psychologically terrorize victims, such as playing scream sounds and forcing system crashes, indicating a dual focus on data theft and intimidation.