Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries) — Threadlinqs Intelligence
As of 2026-07-11, Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries) is a high-severity malware threat attributed to Y2K Operators, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 45 indicators of compromise.
Threat ID: TL-2026-1222 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Y2K Operators · FINANCIAL
Millenium RAT, a commodity Remote Access Trojan sold as malware-as-a-service by developer "shinyenigma," has been rewritten from .NET to native C++ in version 4 to evade signature detection and drop
Millenium RAT is a commodity Windows Remote Access Trojan first documented in November 2023 (as v2.4, reported by CYFIRMA) and sold as Malware-as-a-Service by a developer operating under the handle "shinyenigma," who openly advertises the tool on underground forums (including Dread), GitHub, GitLab, Gitea, and a dedicated promotional website (milleniumrat[.]online). Pricing follows a subscription model: $50 for the first month, $10 for subsequent months, or $90 for lifetime access, placing full-featured RAT capability within reach of low-skilled threat actors.
Version 4.* represents a fundamental architectural shift: the malware has been rewritten from .NET to native C++, eliminating the .NET runtime dependency that previously aided detection and substantially raising the bar for signature-based defenses. The C++ build links libcurl for HTTP/HTTPS communication and continues the project's signature design choice of using the Telegram Bot API as its sole command-and-control channel, avoiding the cost and detectability of dedicated C2 infrastructure. Commands are polled via repeated HTTPS requests to the Telegram Bot API getUpdates endpoint and follow a structured format (/[botid]*command*parameter1*parameterN) using a randomly generated four-digit bot identifier created at first execution, which blends malicious traffic into legitimate, encrypted Telegram API calls and complicates network-based detection.
The embedded configuration is stored as a PE RCDATA resource: Base64-encoded, then further obscured with a custom XOR routine keyed to a password string compiled into the binary, with random Base64 padding inserted between the configuration blob and its separator specifically to alter file hashes across samples without changing operational behavior — a deliberate anti-signature technique. The decoded pipe-delimited configuration string supplies the Telegram bot token, chat ID, mutex/semaphore name, polling delays, persistence file/folder names, keylogger settings, and dozens of feature flags (including detect_sandbox and procmon flags used for anti-analysis).
On execution, the malware copies itself to an attacker-configured %APPDATA% subdirectory under an attacker-configured filename, and establishes persistence via a Run-key autorun entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Later-stage samples increasingly masquerade as legitimate system or security processes (svchost.exe, MsEdgeUpdate.exe, Microsoft Antivirus.exe) rather than using social-engineering-themed filenames, reflecting operational maturity. The malware relies solely on the standard Windows UAC consent prompt for privilege elevation — it implements no UAC bypass exploit, depending instead on victim approval. It also attempts to disable or weaken Windows Defender by modifying preferences and excluding drives (e.g. C:\) from scanning.
Capability-wise Millenium RAT v4 is a full-spectrum RAT: browser credential/cookie/history theft, cryptocurrency wallet browser-extension targeting, Telegram and Discord session-file theft, keystroke logging, screenshot capture, webcam image capture, audio recording (capped at 15 seconds), system/software/process reconnaissance, desktop document harvesting (.pdf/.txt), file execution, ransomware-style file encryption, and destructive system-shutdown/BSOD triggering. Collected data is staged locally as a .zip archive before exfiltration, primarily over the Telegram Bot API channel with the Gofile cloud-storage service as a secondary exfiltration path.
Distribution is entirely social-engineering driven, using four recurring lure themes: (1) fraud/cybercrime utilities (credit-card generators, gift-card generators, crypto balance checkers), (2) hacking/OSINT tooling (WiFi cracking tools, Instagram OSINT extractors, pentest bundles), (3) cracked software including license-defeat and KYC-bypass utilities, and (4) gaming-community lures (Roblox username checkers, cheat tools, config files). A particularly notable oper
Weaknesses (CWE)
CWE-506, CWE-311, CWE-522, CWE-798
Target sectors: all sectors opportunistic, gaming, cybercriminal-underground
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 45 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.002, T1059.001, T1059.003, T1106, T1204.002, T1547.001, T1548.002, T1140, T1562.001