A Windows remote access trojan called KGB RAT is being rented out on underground forums for as little as $150 a month, and buyers get far more than remote control: credential theft, keylogging, a hidden desktop, a ransomware module and a menu of scare tactics its developers call "fun settings". Malware analysts Alpomish Asadov and Razvan Raducu of Group-IB took the tool apart in a new report.
The pitch matters as much as the code. KGB RAT's website dresses the malware up as a legitimate "Remote Administration Tool", complete with customer reviews Group-IB describes as fake, a claim of more than 10,000 IT professional users, how-to videos and a legal section urging lawful use. The forum adverts are blunter, promising a build with a "fud crypter" that lets the buyer "hack anyone windows easily".
A cheap subscription with a ransomware add-on
Group-IB says the tool is sold as malware-as-a-service with free and paid tiers. Paid plans start at $150 for one month and run to $800 for a year, and a separate $500 "Network Spreading" add-on claims to automate movement inside a compromised network. Even the cheapest package includes remote desktop access, webcam and microphone capture, file management, keylogging and password recovery from browsers and applications. The developers say the bundled crypter is updated daily to stay ahead of Windows Defender and other antivirus signatures, and no port forwarding is needed, which lowers the bar for inexperienced buyers.
The harassment features stand out. The builder offers screamer sounds, jump scares and forced blue screens of death, which Group-IB reads as a sign that the customer base runs from financially motivated criminals to people simply out to frighten a victim. KGB RAT has been promoted on forums since late 2025, but Group-IB found a reference to a version 0.1 KGB RAT server dating to late January 2022, so it has been in development far longer than its marketing suggests.
An old njRAT core under new branding
Most samples Group-IB examined are .NET executables written in VB.NET that static tooling identifies as njRAT (0.7D Lime Edition), a long-running commodity trojan, so existing njRAT signatures also match this family. In the researchers' sandbox runs the malware copied itself into the user's Temp folder as svchost.exe, created a scheduled task named ChromeUpdate that runs at every logon, hid protected files in Explorer through a registry change, and switched off Windows attachment zone checks. It profiled the machine through WMI, including which antivirus product was installed, sent that fingerprint to its command server, polled the keyboard for keystrokes and accessed the Windows Credential Manager vault.
Comparing configurations across samples, Group-IB concluded that several distinct operators share one builder. Most samples call back to a single server, while one uses a different host on port 443 to blend in with web traffic. Only three carried the Telegram bot details used to alert operators to new victims, and one had the CryptoClipper module switched on, swapping copied Bitcoin, Ethereum and TRON wallet addresses for the attacker's own.
Hunt for ChromeUpdate and obito.txt
Because the crypter is built to beat signatures, Group-IB recommends behavioral detection. Useful artifacts from the report include:
- A scheduled task named ChromeUpdate launching svchost.exe from a user Temp folder at logon
- A marker file named obito.txt in the Temp directory
- Registry writes setting ShowSuperHidden to 0 and SEE_MASK_NOZONECHECKS to 1
- C2 traffic to 104[.]248[.]130[.]195 on ports 7489 to 7492, or to 2[.]59[.]134[.]215 on port 443, using the |Ghost| command delimiter
- Requests to the Telegram Bot API and ip-api[.]com from processes that have no business making them
Cheap, rebranded trojans keep turning up in new wrappers, from sandbox-dodging loaders to fake software downloads. None of KGB RAT's tricks are new. What makes it worth watching is the packaging: a years-old trojan core, a crypter refreshed daily and a storefront polished enough to pass for real software, sold to anyone with $150.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.