# Millenium RAT v4.x — Native C++ Telegram-Controlled Remote Access Trojan & Infostealer Sold as Malware-as-a-Service (ShinyEnigma)

> Millenium RAT is a Windows Remote Access Trojan and infostealer distributed as Malware-as-a-Service by the actor 'ShinyEnigma'. Group-IB reports version 4.x was rewritten from .NET to a native C++ application, removing the .NET runtime dependency while retaining serverless Telegram Bot API command-and-control. The operation is tied to 62,289 compromised endpoints across 160+ countries, with 39,730 infections (63.8%) in Q1 2026 alone.

- **Published:** 2026-06-25T00:00:00Z
- **Last reviewed:** 2026-06-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0942
- **ID:** TL-2026-0942
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** ShinyEnigma
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Millenium RAT is a commodity Windows Remote Access Trojan and credential/cryptocurrency stealer marketed as a low-cost Malware-as-a-Service (MaaS) by an actor using the handle 'ShinyEnigma' (also 'shinyenigma'), with active exploitation attributed by Group-IB to a cluster tracked as 'Y2K Operators'. The malware first surfaced in November 2023 (CYFIRMA, version 2.4), where it was assessed as a derivative of the open-source ToxicEye Telegram RAT, sharing structure, modules, namespaces and function names. By June 2026 the project had been rewritten: Group-IB's 25 June 2026 analysis documents version 4.x as a native C++ application compiled to a standalone PE, eliminating the .NET Framework runtime dependency present in earlier builds and reducing detection surface.

C2 is serverless: rather than operating dedicated infrastructure, each build communicates with the Telegram Bot API over HTTPS using the getUpdates polling method, with an embedded bot token and chat id. Operator commands are issued through the Telegram chat in the form /[4-digit-botid]*command*parameter1*parameter2, exposing 50+ implemented functions. Configuration is stored in an embedded PE RCDATA resource as a Base64-encoded, custom-XOR-encrypted blob containing fields including token, id, name (used simultaneously as the mutex identifier and HKCU registry value name), start_delay, query_delay, keylog_filename, install_foldername, and boolean feature flags persist, keylogger, elevate, auto_steal and detect_sandbox.

Capabilities span the full RAT/stealer feature set: extraction of browser-stored passwords, cookies and history; theft of Telegram and Discord session/token data; cryptocurrency wallet and browser-extension wallet recovery ('walletRecovery'); keylogging; screenshot capture; 15-second audio recording; webcam access; and host reconnaissance (administrator-privilege check, CPU/GPU, total RAM, Hardware ID, Windows version, architecture, antivirus status, installed software). Destructive/impact functions include file encryption and decryption, system shutdown and restart, BSOD triggering, and display rotation. Persistence is achieved via an HKCU\Software\Microsoft\Windows\CurrentVersion\Run autorun entry and installation of the executable into a %APPDATA% subfolder, with an HKCU\Software\[name] semaphore key tracking first-versus-subsequent execution. Anti-analysis features include sandbox and AV/EDR detection, Windows Defender preference modification, configuration obfuscation, and a self-uninstall routine.

Distribution relies on social-engineering lures hosted on attacker-controlled domains and file hosts: fraud utilities (gift-card/crypto generators), 'hacking toolkits' (OSINT, WiFi cracking), software cracks/KYC-bypass tools, Roblox-themed game cheats, and trojanized builders of other RATs (XWorm, AsyncRAT, njRAT). Payloads are commonly delivered via LNK shortcuts disguised as PDFs, PowerShell downloaders and VBS intermediaries that stage a decoy document while silently executing the RAT. Exfiltration is performed over the Telegram Bot API and the Gofile cloud-storage service, with staged data Base64-encoded. The developer advertised the project on a marketing site (milleniumrat.online), Dread forum posts, and code-hosting repositories on GitHub, GitLab and Gitea; pricing for v4.x is $50 for the first month, $10 for subsequent months, or a one-time $90 lifetime purchase (down-market from the $30 lifetime price of v2.4).

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1674 Input Injection
- T1106 Native API
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1217 Browser Information Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1012 Query Registry
- T1518 Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1033 System Owner/User Discovery
- T1560 Archive Collected Data
- T1123 Audio Capture
- T1074 Data Staged
- T1005 Data from Local System
- T1056 Input Capture
- T1113 Screen Capture
- T1125 Video Capture
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1529 System Shutdown/Reboot

## Sources

- [Millenium RAT: anatomy of a Malware-as-a-Service operation](https://www.group-ib.com/blog/millenium-rat-maas/)
- [Unveiling a New Threat: The Millenium RAT](https://www.cyfirma.com/research/unveiling-a-new-threat-the-millenium-rat/)
- [BrinzTech Technical Advisory: Telegram C2 Infiltration Vectors and Crypto-Bound Decryption — The Millenium RAT Commercialization Cycle](https://www.brinztech.com/breach-alerts/brinztech-technical-advisory-mobile-api-logic-abuses-telegram-c2-infiltration-vectors-and-crypto-bound-decryption-architecture-the-millenium-rat-commercialization-cycle)
- [KrakenLabs: shinyenigma selling Millenium RAT v4.1 (C++ Telegram RAT + stealer)](https://x.com/KrakenLabs_Team/status/1960282483846533219)
- [GitHub repository — Shinyenigma-official/Millenium-RAT](https://github.com/Shinyenigma-official/Millenium-RAT)
- [Deepwatch Cyber Intel Brief: November 02-08, 2023 (Millenium RAT)](https://www.deepwatch.com/labs/cyber-intel-brief-november-02-08-2023/)
- [CloudSEK / SC Media: XWorm RAT builder leveraged for widespread device compromise](https://www.scworld.com/brief/xworm-rat-builder-leveraged-for-widespread-device-compromise)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0942