Millenium RAT is a commodity Windows Remote Access Trojan first documented in November 2023 (as v2.4, reported by CYFIRMA) and sold as Malware-as-a-Service by a developer operating under the handle "shinyenigma," who openly advertises the tool on underground forums (including Dread), GitHub, GitLab, Gitea, and a dedicated promotional website (milleniumrat[.]online). Pricing follows a subscription model: $50 for the first month, $10 for subsequent months, or $90 for lifetime access, placing full-featured RAT capability within reach of low-skilled threat actors.

Version 4.* represents a fundamental architectural shift: the malware has been rewritten from .NET to native C++, eliminating the .NET runtime dependency that previously aided detection and substantially raising the bar for signature-based defenses. The C++ build links libcurl for HTTP/HTTPS communication and continues the project's signature design choice of using the Telegram Bot API as its sole command-and-control channel, avoiding the cost and detectability of dedicated C2 infrastructure. Commands are polled via repeated HTTPS requests to the Telegram Bot API getUpdates endpoint and follow a structured format (/[botid]*command*parameter1*parameterN) using a randomly generated four-digit bot identifier created at first execution, which blends malicious traffic into legitimate, encrypted Telegram API calls and complicates network-based detection.

The embedded configuration is stored as a PE RCDATA resource: Base64-encoded, then further obscured with a custom XOR routine keyed to a password string compiled into the binary, with random Base64 padding inserted between the configuration blob and its separator specifically to alter file hashes across samples without changing operational behavior — a deliberate anti-signature technique. The decoded pipe-delimited configuration string supplies the Telegram bot token, chat ID, mutex/semaphore name, polling delays, persistence file/folder names, keylogger settings, and dozens of feature flags (including detect_sandbox and procmon flags used for anti-analysis).

On execution, the malware copies itself to an attacker-configured %APPDATA% subdirectory under an attacker-configured filename, and establishes persistence via a Run-key autorun entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Later-stage samples increasingly masquerade as legitimate system or security processes (svchost.exe, MsEdgeUpdate.exe, Microsoft Antivirus.exe) rather than using social-engineering-themed filenames, reflecting operational maturity. The malware relies solely on the standard Windows UAC consent prompt for privilege elevation — it implements no UAC bypass exploit, depending instead on victim approval. It also attempts to disable or weaken Windows Defender by modifying preferences and excluding drives (e.g. C:\) from scanning.

Capability-wise Millenium RAT v4 is a full-spectrum RAT: browser credential/cookie/history theft, cryptocurrency wallet browser-extension targeting, Telegram and Discord session-file theft, keystroke logging, screenshot capture, webcam image capture, audio recording (capped at 15 seconds), system/software/process reconnaissance, desktop document harvesting (.pdf/.txt), file execution, ransomware-style file encryption, and destructive system-shutdown/BSOD triggering. Collected data is staged locally as a .zip archive before exfiltration, primarily over the Telegram Bot API channel with the Gofile cloud-storage service as a secondary exfiltration path.

Distribution is entirely social-engineering driven, using four recurring lure themes: (1) fraud/cybercrime utilities (credit-card generators, gift-card generators, crypto balance checkers), (2) hacking/OSINT tooling (WiFi cracking tools, Instagram OSINT extractors, pentest bundles), (3) cracked software including license-defeat and KYC-bypass utilities, and (4) gaming-community lures (Roblox username checkers, cheat tools, config files). A particularly notable operational signature is that Y2K Operators backdoor popular open-source RATs and exploit builders (AsyncRAT, XWorm, njRAT) and redistribute the trojanized versions, turning aspiring or copycat attackers who download these tools into unwitting Millenium RAT victims. One documented delivery chain uses a .lnk shortcut disguised as a PDF that triggers PowerShell execution (via the mcdir.me proxy infrastructure) and a VBS script, displaying a decoy PDF document while silently deploying the RAT in the background.

Group-IB tracks the operators of this campaign as "Y2K Operators" and reports 62,289 cumulative compromised Windows endpoints across 160+ countries, with 39,730 new infections recorded in Q1 2026 alone — a sharp acceleration attributable to the v4 C++ rewrite's improved evasion and the group's aggressive backdooring of third-party tooling. Victimology is broadly opportunistic across all industries and geographies, with no evidence of sector-specific targeting; this is consistent with a commodity-crimeware MaaS operation rather than a targeted APT campaign. No CVE or CVSS applies, as this is malware distribution rather than a vulnerability. Recommended defensive posture per Group-IB includes avoiding executables from untrusted sources, prompt patching, MFA enforcement, scrutiny of unexpected UAC prompts, monitoring for anomalous autorun registry entries, and flagging system-named processes executing from user-writable directories, alongside network monitoring for anomalous outbound Telegram Bot API traffic from unusual hosts.