KGB RAT: An NjRAT Remix Sold as a Service, With a "Fully Undetectable" Pitch

A remote access trojan marketed as KGB RAT is being rented to criminals as a turnkey Windows spying kit. It bundles credential theft, keylogging, hidden remote control and a crypto clipper. Its sellers promise a crypter that slips past Windows Defender. Research by Group-IB shows the toolkit is real and capable. It also shows that the "undetectable" marketing deserves skepticism.

What happened

Group-IB analysts identified and took apart KGB RAT. It has been advertised on underground forums since late 2025, but parts of its server infrastructure appear to go back as far as January 2022. It is sold under a malware-as-a-service model, so buyers pay for access instead of writing anything themselves. The seller promises daily crypter updates and a builder that outputs payloads as EXE, BAT, HTA and REG files.

The storefront presents the product as a "professional remote administration tool". Under that branding, the analyzed samples are built on an obfuscated NjRAT, a long-known open-source RAT, wrapped in a commercial package. In other words, KGB RAT is not a new technique. It's an old engine with new paint and a subscription model.

In the sample Group-IB examined, the malware:

• Masquerades and persists: it copies itself into a temporary folder, relaunches as svchost.exe and registers a scheduled task named ChromeUpdate that runs at user logon.
• Tampers with settings: it changes the Windows setting for showing hidden system files and alters a security-zone warning setting.
• Profiles the host first: it queries WMI for the OS, running processes and installed security products, and checks for virtual machines and analysis tools to avoid sandboxes.
• Steals credentials: it reads Windows Credential Manager data (saved logins for websites, network shares and apps). It also includes a keylogger and can capture screenshots and the clipboard.
• Controls the desktop covertly: a hidden VNC (HVNC) module gives the operator a remote session the victim may never see.
• Phones home twice: it looks up the victim's public IP through a geolocation service and reports new infections to the operator through the Telegram Bot API. Remote control itself runs over direct connections to command-and-control (C2) servers.
• Hijacks crypto payments: one sample included a clipper that swaps copied wallet addresses for the attacker's.

About the "bypasses Defender" claim

This is the part to read carefully. The sellers claim the crypter can bypass or disable Windows Defender and other antivirus tools. Group-IB documented the advertised evasion and the malicious behavior. It did not show that every build reliably defeats Defender on every system. Its own detonation platform caught the samples by behavior, even after obfuscation or unpacking.

A crypter changes what a file looks like, but it doesn't change what the malware does. That's where defenders have the advantage.

Why it matters

Commodity RATs like this lower the barrier to entry. A buyer with no development skills gets credential theft, persistence and hands-on-keyboard access in one package. A single infected workstation can expose saved corporate credentials, VPN and SaaS sessions, and crypto transfers. That makes the initial foothold for a larger intrusion cheap to obtain.

What to do

1. Keep endpoint protection on and current. Make sure Defender or your EDR has tamper protection enabled and behavior-based detection turned on, not only signatures.
2. Hunt for the behavioral tells. Look for executables running from %TEMP% or other user-writable folders, a svchost.exe outside C:\Windows\System32, and new scheduled tasks (especially ChromeUpdate) created by such processes.
3. Watch outbound traffic from non-browser processes. Alert when api.telegram.org or IP-geolocation services are contacted by anything other than an approved app. Add the published C2 addresses to your blocklists.
4. Restrict unapproved software. Use application allow-listing (WDAC/AppLocker) and block script-based payload formats such as HTA where they aren't needed.
5. Reduce what a stealer can grab. Discourage saving credentials in Windows Credential Manager and browsers for privileged accounts, and enforce phishing-resistant MFA.
6. If you suspect infection, isolate the device, preserve logs, and investigate from a clean system. Then reset every credential and session that was used on the machine.

Network indicators (defanged)

Group-IB's report also lists SHA-256 file hashes for the analyzed samples. Import them from the original research into your threat intelligence platform or SIEM.

Need help checking whether your endpoints and exposed services would catch a threat like this? The 4Tify team can help assess your attack surface.

Original research: Group-IB. Coverage: Cyber Security News.