Threat reportMalwareTL-2026-3487
KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD crypter
KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD (TL-2026-3487), also tracked as KGB RAT, is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Windows, maps to 25 MITRE ATT&CK techniques (T1027, T1027.002, T1036.005), and is covered by 9 detection rules and 36 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 36Indicators of compromise
Key facts for TL-2026-3487
- Threat ID
- TL-2026-3487
- Also known as
- KGB RAT, KGB RAT FUD
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- general, individuals, cryptocurrency users
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 36
Malware and tooling in KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD
Malware and tooling: Crypter, KGB RAT, NJRat, njRAT
How KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD works
KGB RAT is a Windows remote access trojan derived from NjRAT (Bladabindi) and marketed on underground forums as a fully undetectable (FUD) Malware-as-a-Service with a free tier and paid subscriptions. It offers Hidden VNC, keylogging, browser credential theft, ransomware and a crypto-clipboard hijacker, and Group-IB observed multiple operators sharing the same builder.
KGB RAT is a VB.NET Windows RAT (x86 PE) built on the NjRAT 0.7D Lime Edition/Bladabindi codebase and promoted as 'administration software' under a subscription MaaS model. Group-IB reports underground-forum promotion from late 2025, with infrastructure evidence for an early version (v0.1) dating to late January 2022. A free tier provides basic remote desktop, file management, camera/microphone access, keylogging, password recovery, persistence and anti-detection; paid plans are priced from $150/month to $800/year, with a $500 'Network Spreading' add-on for automated LAN lateral movement. A daily-updated crypter and a Unique Stub Generator (USG) produce distinct stubs to keep samples undetectable by signature AV. The builder emits EXE, BAT, REG and HTA payloads and a binder that attaches the stub to legitimate executables. Group-IB analyzed unobfuscated, obfuscated and encrypted-dropper variants.
Capabilities include Hidden VNC (HVNC), live webcam and microphone capture, file management (upload, download, delete, modify), keystroke logging (polling and hooks), screen capture (CopyFromScreen), browser, Windows Credential Manager and application password recovery, ransomware, USB propagation, LAN spreading, a BotKiller class that removes rival malware (observed in one sample), and a CryptoClipper module that swaps clipboard wallet addresses (BTC, ETH, TRC-20) with operator-controlled ones, storing values under HKCU\Software\Clipper. A 'Fun Settings' set of harassment features adds screamer audio playback (%TEMP%\scream.wav), jump scares, fake error dialogs and forced blue screens via the ProcessBreakOnTermination (Critical Process, flag 29) setting.
Execution and evasion: the stub uses runtime deobfuscation and reflective code loading, process hollowing with suspended creation, a 600-second delayed-execution routine, a 4-second C2 polling loop (4,412 iterations, about 4.9 hours, observed), mouse-click monitoring via GetAsyncKeyState to detect sandboxes, motherboard-string checks (VGNZPL985D, Test, Sandbox, Temp, Debug, Default, Trial, Virtual Machine/VM, Hyper, D1120, 700-210xt) and VM-service checks (VGAuthService, VBoxService), and it terminates analysis tools (procexp, SbieCtrl, SpyTheSpy, wireshark, apateDNS, IPBlocker, TiGeR-Firewall, smsniff, exeinfoPE, NetSnifferCs, processhacker, dnSpy, CodeReflect, Reflector, ILSpy). UAC is bypassed through HKCU\Software\Classes\ms-settings\shell\open\command (Default and DelegateExecute) with ComputerDefaults.exe, and also mscfile. The sample copies itself to %TEMP%\svchost.exe (two samples use %AllUsersProfile%), spawns cmd.exe, powershell.exe, reg.exe and schtasks.exe, and creates a scheduled task named 'ChromeUpdate' (ONLOGON, HIGHEST run level; name configurable via OK.SCHEDNAME). Persistence also uses HKCU\...\Policies\Explorer\Run (value 'Loader'), Startup-folder files and .url shortcuts, and default file association hijacking; WMI queries support discovery and execution. Hardcoded configuration values across samples include injection target svchost.exe, bypass process MoUsoCoreWorker.exe, command delimiter '|Ghost|', Base64 victim separators (Victim, King, KING), the guard file %TEMP%\obito.txt and the developer string 'WhyYouReverseMe..ImInnocent..LoveYouu..'. It sets HKCU\Environment\SEE_MASK_NOZONECHECKS=1 (an NjRAT trait) and ShowSuperHidden=0. The initial beacon carries hostname, username, date, OS version, admin status and installed AV products.
Command and control: samples beacon to 104.248.130.195 (TCP 7489, 7490, 7492; six samples, a single operator) and 2.59.134.215 (TCP 443, one sample, blending with HTTPS); kgbrat.org is the malware website. Some operators use the Telegram Bot API (api.telegram.org/bot*/sendMessage) for notification or exfiltration (two distinct bot tokens observed; one shared across two samples with different chat IDs) and victim geolocation via ip-api.com/json/. Shared infrastructure suggests a primary actor with a reseller network. Only one sample enabled the CryptoClipper for direct financial gain. Group-IB states that developers are identifiable via nicknames and social media profiles; no nation-state attribution is stated. Severity is analyst-assigned (not stated in the source), and no CVEs or CVSS apply.
MITRE ATT&CK techniques used in TL-2026-3487
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1134 Access Token Manipulation; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks; T1497.003 Virtualization/Sandbox Evasion: Time Based Checks; T1564.003 Hide Artifacts: Hidden Window; T1620 Reflective Code Loading
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1546.001 Event Triggered Execution: Change Default File Association; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation
T1055.012 Process Injection: Process Hollowing; T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Credential Access
T1056.001 Input Capture: Keylogging; T1555.004 Credentials from Password Stores: Windows Credential Manager
Discovery
T1057 Process Discovery; T1082 System Information Discovery
defense-impairment
Affected products and versions in KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD
- Microsoft — Windows
Vulnerable versions: Windows endpoints (no specific versions stated)
Remediation for KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD
Immediate actions
- Block 104.248.130.195 (TCP 7489/7490/7492), 2.59.134.215 (TCP 443) and kgbrat.org at the perimeter
- Hunt for scheduled task 'ChromeUpdate' created with /sc ONLOGON /rl HIGHEST from %TEMP%
- Hunt for HKCU\Software\Classes\ms-settings\shell\open\command and mscfile\shell\open\command modifications and %TEMP%\obito.txt, %TEMP%\svchost.exe
- Alert on unexpected egress to api.telegram.org and ip-api.com from non-browser processes
- Search endpoints for the listed SHA-256 hashes
- Report observed Telegram bot tokens to Telegram abuse for deactivation
Workarounds
- Set UAC to always notify and restrict standard users from writing HKCU shell-handler keys via EDR policy
- Restrict egress to Telegram API and geolocation services where not business-required
- Audit scheduled tasks periodically for 'ChromeUpdate' and dismiss unexpected UAC prompts after running downloaded files
Longer-term hardening
- Deploy behavioral EDR rather than relying on signature AV, since the crypter is updated daily
- Enforce application allow-listing that blocks unsigned binaries running from user-writable paths
- Monitor WMI queries and process-creation chains (dropper -> svchost.exe in %TEMP% -> cmd/powershell/reg/schtasks)
- Detonate suspicious binaries in a sandbox before endpoint deployment and consume continuous threat-intel feeds
Timeline of KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD
- Parent NjRAT (Bladabindi) first observed in 2012 per MITRE ATT&CK S0385 (month/day approximated); KGB RAT derives from the NjRAT 0.7D Lime Edition codebase.
- MITRE ATT&CK creates the njRAT (S0385) software entry used as the reference baseline for the parent family's techniques.
- Infrastructure evidence for an early KGB RAT version (v0.1) dating to late January 2022 (day approximated from 'late January').
- Public breach-alert reporting related to KGB RAT noted by Group-IB in September 2025 (day approximated).
- Late 2025: active underground-forum campaign promoting KGB RAT as a FUD MaaS with free and paid tiers ($150/month, $800/year, $500 Network Spreading add-on; day approximated).
- Threat ingested by Threadlinqs hunt pipeline as a new MaaS RAT family (NjRAT-based) with active operators.
- Group-IB (Alpomish Asadov, Razvan Raducu) publishes technical analysis of KGB RAT, documenting multiple operators, C2 infrastructure, 39 mapped ATT&CK techniques and a CryptoClipper module.
Sources cited for KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD
Detection coverage for TL-2026-3487
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3487 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.