KGB RAT Trojan Offers Webcam Access and Password Theft for $150 Monthly
A new Windows trojan known as KGB RAT is being marketed on hacking forums for as low as $150 per month, promising buyers access to a victim's webcam, microphone, keystrokes, and saved passwords. This malware, analyzed by Group-IB malware experts Alpomish Asadov and Razvan Raducu, is based on NjRAT, a well-known remote access trojan utilized by attackers of varying skill levels.
KGB RAT first emerged in public security reports in September 2025, when it was flagged as a newly identified threat. Its promotion on hacking forums gained traction in late 2025, indicating a growing interest among cybercriminals. Researchers also discovered a public disclosure from January 2022 that referenced a KGB RAT server at version 0.1, suggesting that the developers had been refining the tool for years before its public release.
The KGB RAT website markets the software as an advanced Windows administration tool, boasting features such as complete Windows control, military-grade encryption, and 100% Fully Undetectable (FUD) technology. However, beneath this marketing facade lies a comprehensive surveillance and control toolkit. Group-IB noted that the developers have gone to great lengths to present KGB RAT as legitimate software, complete with fake customer reviews and claims of usage by over 10,000 IT professionals.
Promotional ads on forums are more direct, with one stating that buyers can easily hack any Windows system using this RAT. Key selling points include the ability to bypass and disable Windows Defender and other antivirus programs, as well as the ease of use for less experienced attackers, as it does not require port forwarding.
Subscription plans start at $150 for one month and can reach up to $800 for a year, with discounts for renewals. The basic package includes remote desktop access, file management, camera and microphone access, keylogging, password theft, and anti-detection features. Higher-tier plans offer additional capabilities, such as managing multiple infected computers, payload customization, and access to more servers.
A separate $500 add-on for "Network Spreading" claims to automate the malware's spread within compromised networks. KGB RAT also includes ransomware functionality, allowing attackers to escalate from initial access to extortion without needing additional tools.
Capabilities of KGB RAT in Action
The trojan's features include a hidden remote desktop session that the victim cannot see, along with control over the victim's screen, mouse, and keyboard. In testing, the malware successfully logged keystrokes and accessed the Windows Credential Manager, which stores login details for various applications. The developers advertise the ability to steal passwords saved by browsers and other software, with keylogging enabled in every sample examined.
Upon connecting to its command server, the malware transmits the victim's computer name, username, Windows version, and antivirus product details. It also retrieves the victim's public IP address and location information, which can be sent to a Telegram bot, alerting the operator when a new victim connects. Additionally, one module monitors the clipboard for cryptocurrency wallet addresses, swapping them for addresses controlled by the attacker.
The KGB RAT developers have included features designed to harass and intimidate victims, such as playing scream sounds and forcing the computer to crash. These "fun settings" suggest a developer community that includes both financially motivated cybercriminals and less sophisticated actors seeking to disrupt or intimidate.
In testing, the trojan disguises itself as a standard Windows process by copying itself into the temporary folder under the name svchost.exe. It creates a scheduled task named ChromeUpdate, which launches the malware at every login with the highest privileges. The malware also modifies Windows settings to hide protected system files and bypass security checks.
Final Assessment
To avoid detection by security researchers, KGB RAT includes mechanisms to stop running if it detects certain virtual machine names or analysis tools. Some samples pause for extended periods to evade automated analysis systems.
KGB RAT exemplifies how established malware remains relevant through accessible packaging and ongoing maintenance. The availability of such a maintained attack tool allows operators to utilize familiar capabilities against various victims, extending the reach of this otherwise unremarkable malware family.
