A Windows remote access trojan called SiriusQT has been on sale on underground forums since April 2026, and Group-IB says it is far more than the "remote administration tool" its sellers advertise. In a detailed analysis, the company describes a single implant that combines hidden remote control, browser automation, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging and process injection, all over custom encrypted command-and-control traffic.
Group-IB says campaigns using it targeted, among others, the United Kingdom, Germany, France, Spain, Italy and the Netherlands.
One seller, two markets
The tool's built-in "about" screen names an author called "Amonus", but Group-IB found no direct evidence linking that name to development or distribution. The only clearly visible seller is GhostKernel, an actor active on underground forums and Telegram since February 2026 who also advertised BTMob, an Android RAT with banking features. GhostKernel promoted SiriusQT v1.0.5 as a lifetime product for US$500, with monthly and three-month tiers below that, customer support and update channels on Telegram.
At least 30 buyers held a valid license, according to Group-IB. But cracked builds, often shipped with a Python key generator, spread freely on forums and even GitHub from April onward, and some came bundled with extra malware. Of 146 unique licenses Group-IB extracted from samples, 110, almost 75%, were leaked ones. The result is two parallel markets for the same malware: paying customers who want support and updates, and opportunists running free copies.
Licenses that track the operators
Every SiriusQT client embeds the license used to build it, which turned out to be a useful fingerprint. Group-IB tracked one operator who ran at least eight campaigns between late March and early June 2026, let a 30-day license lapse, then bought a lifetime license about a week later rather than switch to a cracked key. Unusual license lengths of 14, 28, 45 and 99 days point to private deals between the seller and individual buyers. Campaign tags in the configurations included "Whatsapp", "UAE", "Mini Stub Mexico" and "China + Taiwan", which may reflect lures or targets, though Group-IB treats them as operator notes rather than confirmed victimology.
Across more than 280 public samples, Group-IB found SiriusQT typically arriving as the last stage behind the UpCrypter loader, which carries much lower detection rates than the RAT itself. Its infrastructure overlaps with Remcos, XWorm, AsyncRAT and QuasarRAT operations, and one command server had previously been linked to RedLine Stealer. One operator ran command-and-control from Google Cloud addresses, which are rarely blocked by corporate firewalls; that same IP had appeared in past NetWire campaigns.
Built to stay hidden and to steal
The operator's console lets an attacker browse files, the registry, services and scheduled tasks, run CMD and PowerShell, add Windows Defender exclusions and pull recovered passwords, cookies and wallets into a single view. A builder can switch on anti-VM checks and refuse to run on machines whose locale belongs to CIS countries, a common trait in Russian-speaking crimeware, and a Telegram bot can manage the whole thing. In one configuration Group-IB decoded, the client installs under %APPDATA%\Microsoft as svchost.exe.
Block the C2s and watch for UpCrypter
Defenders should block the infrastructure below, alert on new Windows Defender exclusions and on svchost.exe running from a user profile, and treat UpCrypter detections as a likely precursor. Selected indicators from Group-IB's report:
- server[.]activeworkshops[.]com (ports 16614 and 31166)
- 2[.]27[.]62[.]140:4449
- serios[.]ydns[.]eu:4449
- xweb[.]ddns[.]net:7070 and afxxwd[.]ddns[.]net:7070
- 34[.]41[.]139[.]193 (Google Cloud)
SiriusQT is another sign that commodity malware is converging on an all-in-one model, the same pattern IntelFusions saw with the KGB RAT subscription service. When cracked copies of a $500 tool are free, the barrier to running a full theft-and-takeover operation is close to zero, and the license data Group-IB used to separate paying operators from freeloaders is one of the few clues defenders get.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.