# Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries)

> Millenium RAT, a commodity Remote Access Trojan sold as malware-as-a-service by developer "shinyenigma," has been rewritten from .NET to native C++ in version 4 to evade signature detection and drop the .NET runtime dependency. Group-IB attributes ongoing global distribution to a cluster tracked as "Y2K Operators," reporting 62,289 compromised Windows devices across 160+ countries, including 39,730 new infections in Q1 2026 alone, delivered via trojanized cracked software, game utilities, hacking tools, and even backdoored copies of other RATs (AsyncRAT, XWorm, njRAT).

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1222
- **ID:** TL-2026-1222
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Y2K Operators
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Millenium RAT is a commodity Windows Remote Access Trojan first documented in November 2023 (as v2.4, reported by CYFIRMA) and sold as Malware-as-a-Service by a developer operating under the handle "shinyenigma," who openly advertises the tool on underground forums (including Dread), GitHub, GitLab, Gitea, and a dedicated promotional website (milleniumrat[.]online). Pricing follows a subscription model: $50 for the first month, $10 for subsequent months, or $90 for lifetime access, placing full-featured RAT capability within reach of low-skilled threat actors.

Version 4.* represents a fundamental architectural shift: the malware has been rewritten from .NET to native C++, eliminating the .NET runtime dependency that previously aided detection and substantially raising the bar for signature-based defenses. The C++ build links libcurl for HTTP/HTTPS communication and continues the project's signature design choice of using the Telegram Bot API as its sole command-and-control channel, avoiding the cost and detectability of dedicated C2 infrastructure. Commands are polled via repeated HTTPS requests to the Telegram Bot API getUpdates endpoint and follow a structured format (/[botid]*command*parameter1*parameterN) using a randomly generated four-digit bot identifier created at first execution, which blends malicious traffic into legitimate, encrypted Telegram API calls and complicates network-based detection.

The embedded configuration is stored as a PE RCDATA resource: Base64-encoded, then further obscured with a custom XOR routine keyed to a password string compiled into the binary, with random Base64 padding inserted between the configuration blob and its separator specifically to alter file hashes across samples without changing operational behavior — a deliberate anti-signature technique. The decoded pipe-delimited configuration string supplies the Telegram bot token, chat ID, mutex/semaphore name, polling delays, persistence file/folder names, keylogger settings, and dozens of feature flags (including detect_sandbox and procmon flags used for anti-analysis).

On execution, the malware copies itself to an attacker-configured %APPDATA% subdirectory under an attacker-configured filename, and establishes persistence via a Run-key autorun entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Later-stage samples increasingly masquerade as legitimate system or security processes (svchost.exe, MsEdgeUpdate.exe, Microsoft Antivirus.exe) rather than using social-engineering-themed filenames, reflecting operational maturity. The malware relies solely on the standard Windows UAC consent prompt for privilege elevation — it implements no UAC bypass exploit, depending instead on victim approval. It also attempts to disable or weaken Windows Defender by modifying preferences and excluding drives (e.g. C:\) from scanning.

Capability-wise Millenium RAT v4 is a full-spectrum RAT: browser credential/cookie/history theft, cryptocurrency wallet browser-extension targeting, Telegram and Discord session-file theft, keystroke logging, screenshot capture, webcam image capture, audio recording (capped at 15 seconds), system/software/process reconnaissance, desktop document harvesting (.pdf/.txt), file execution, ransomware-style file encryption, and destructive system-shutdown/BSOD triggering. Collected data is staged locally as a .zip archive before exfiltration, primarily over the Telegram Bot API channel with the Gofile cloud-storage service as a secondary exfiltration path.

Distribution is entirely social-engineering driven, using four recurring lure themes: (1) fraud/cybercrime utilities (credit-card generators, gift-card generators, crypto balance checkers), (2) hacking/OSINT tooling (WiFi cracking tools, Instagram OSINT extractors, pentest bundles), (3) cracked software including license-defeat and KYC-bypass utilities, and (4) gaming-community lures (Roblox username checkers, cheat tools, config files). A particularly notable operational signature is that Y2K Operators backdoor popular open-source RATs and exploit builders (AsyncRAT, XWorm, njRAT) and redistribute the trojanized versions, turning aspiring or copycat attackers who download these tools into unwitting Millenium RAT victims. One documented delivery chain uses a .lnk shortcut disguised as a PDF that triggers PowerShell execution (via the mcdir.me proxy infrastructure) and a VBS script, displaying a decoy PDF document while silently deploying the RAT in the background.

Group-IB tracks the operators of this campaign as "Y2K Operators" and reports 62,289 cumulative compromised Windows endpoints across 160+ countries, with 39,730 new infections recorded in Q1 2026 alone — a sharp acceleration attributable to the v4 C++ rewrite's improved evasion and the group's aggressive backdooring of third-party tooling. Victimology is broadly opportunistic across all industries and geographies, with no evidence of sector-specific targeting; this is consistent with a commodity-crimeware MaaS operation rather than a targeted APT campaign. No CVE or CVSS applies, as this is malware distribution rather than a vulnerability. Recommended defensive posture per Group-IB includes avoiding executables from untrusted sources, prompt patching, MFA enforcement, scrutiny of unexpected UAC prompts, monitoring for anomalous autorun registry entries, and flagging system-named processes executing from user-writable directories, alongside network monitoring for anomalous outbound Telegram Bot API traffic from unusual hosts.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Spearphishing Link
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1106 Native API
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1027.013 Encrypted/Encoded File
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1217 Browser Information Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1012 Query Registry
- T1518 Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1033 System Owner/User Discovery
- T1560 Archive Collected Data
- T1123 Audio Capture
- T1074.001 Local Data Staging
- T1005 Data from Local System
- T1056.001 Keylogging
- T1113 Screen Capture
- T1125 Video Capture
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1132.002 Non-Standard Encoding
- T1041 Exfiltration Over C2 Channel
- T1567.002 Exfiltration to Cloud Storage
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1529 System Shutdown/Reboot

## Sources

- [Millenium: A RAT Rewritten, A Threat Multiplied](https://www.group-ib.com/blog/millenium-rat-maas/)
- [Millenium RAT Rewritten in C++ Infects 62,000+ Devices Across 160 Countries](https://cybersecuritynews.com/millenium-rat-rewritten-in-c/)
- [Telegram-Based Millenium RAT Campaign Infects 60,000 Devices](https://www.infosecurity-magazine.com/news/millenium-rat-telegram-60000/)
- [Millenium RAT Rewritten in C++ Infects 62,000+ Devices Across 160 Countries](https://www.brightnexus.com/cybersecurity-advisory/article/2819/millenium-rat-rewritten-in-c-infects-62000-devices-across-160-countries)
- [The revamped Millennium RAT has infected over 62,000 devices](https://www.secnews.gr/en/717969/ananeomeno-millennium-rat-62000-devices/)
- [Millenium RAT Uses Base64 and XOR Configuration to Hide Telegram C2 Settings](https://gbhackers.com/millenium-rat-uses-base64-and-xor/)
- [New Millenium RAT version infects 62,000 Windows systems worldwide](https://cyberinsider.com/new-millenium-rat-version-infects-62000-windows-systems-worldwide/)
- [Group-IB: Millenium RAT MaaS campaign summary](https://x.com/GroupIB/status/2070088437005255133)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1222