Skip to content

Image: img.helpnetsecurity.com · rights & removal

KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims

Reporting by Help Net SecurityRead the original at helpnetsecurity.com

Objectivity score: 63 out of 100.
Difficulty 68 out of 100 (Academic)— Read Analysis

Executive Summary

A Remote Access Trojan (RAT) named KGB RAT is being sold on hacking forums, advertised as an advanced surveillance and control toolkit for a subscription fee starting at $150 monthly. Researchers indicate the malware builds upon NjRAT, suggesting established development precedents. While sellers market it with claims of military-grade encryption and complete undetectability, testing confirms it possesses capabilities for webcam/microphone access, keystroke logging, and password theft by targeting Windows Credential Manager. Beyond core espionage functions, the toolkit includes "fun settings" allowing operators to inflict psychological distress via jump scares or forced system crashes.

Facts Only

The malware, KGB RAT, is a Windows trojan promoted on hacking forums for monthly subscriptions beginning at $150 and reaching up to $800 annually. Group-IB analysts identified the tool as being built upon NjRAT. Initial public security reporting flagged the threat in September 2025; broader forum promotion began in late 2025, following a January 2022 disclosure of version 0.1 servers. KGB RAT functions include remote desktop access, file management, keylogging, camera/microphone access, and password theft via Windows Credential Manager. The tool deploys evasion techniques, including renaming itself to svchost.exe and using scheduled tasks named ChromeUpdate. It includes a CryptoClipper module that swaps cryptocurrency wallet addresses associated with BTC, ETH, and TRC-20 for attacker-controlled ones.

Full Take

The packaging of KGB RAT reveals an ecosystem where the operational burden shifts from sophisticated actors to accessible commercial vendors; this democratization of capability is perhaps more significant than any single feature. The juxtaposition of market claims—military encryption, FUD status—against proven capabilities like keystroke logging and forced crashes suggests a deliberate conflation: blending high-stakes surveillance potential with low-barrier harassment tools. The inclusion of psychological torture modules alongside basic data theft points to multiple user profiles being served by the same platform—from financially motivated criminals seeking extortion (bolstered by the ransomware integration) to disruption actors simply wishing to intimidate.
The underlying assumption driving this market is that complexity can be abstracted into a consumable service, effectively turning advanced exploits into scalable SaaS offerings for cyber-enabled crime. This echoes historical patterns of how specialized tools become commoditized

From the original · Help Net Security

A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the screen.
Read the full story at helpnetsecurity.com

Sentinel — Human

Confidence

The article presents a detailed, technically grounded analysis by Group-IB detailing the features and lifecycle of the KGB RAT trojan. The synthesis suggests a professionally researched human report rather than an automated summary.

Signals Detected
low severity: Varying sentence complexity reflecting technical reporting.
low severity: Strong integration of quotes and narrative flow typical of in-depth investigative journalism.
low severity: Specific attribution to 'Group-IB malware analysts Alpomish Asadov and Razvan Raducu,' grounding the claims.
low severity: Internal consistency regarding threat lifecycle (Jan 2022 reference vs. Sept/late 2025 reporting).
Human Indicators
Detailed operational descriptions of evasion techniques (svchost.exe mimicry, Sandbox detection checks).
Nuanced conclusion regarding developer intent: mixture of financially motivated and disruption-focused actors.
Specific financial breakdown ($150/month up to $800) providing granular context.
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims | Huntaegis