KGB RAT is a Windows remote access trojan analyzed by Group-IB researchers and built on the well-known NjRAT codebase. It is marketed on hacking forums and a dedicated website as a legitimate Windows administration tool, with claims of military-grade encryption, full stealth, and daily updates. Group-IB found fake customer reviews and a legal section with disclaimers, but the forum ads were blunter, telling buyers they could hack any Windows machine easily. Subscriptions start at $150 for one month and reach $800 for a year, with optional add-ons such as a $500 network-spreading module.
The trojan gives operators hidden remote desktop access, screen and input control, webcam and microphone capture, keylogging, and access to saved passwords through Windows Credential Manager. In every sample tested, keylogging was enabled. On first contact with its command server, KGB RAT sends system details, queries an IP geolocation service, and can notify the operator via Telegram with the victim's location. One sample also included a CryptoClipper module that replaces cryptocurrency wallet addresses in the clipboard with attacker-controlled addresses, redirecting payments.
Under an "Extra" menu, the developers include so-called fun settings that let operators play scream sounds, show jump scares, and force the computer to crash. Group-IB noted that these harassment features are uncommon in remote access trojans at this capability level and suggest a mix of financially motivated criminals and less sophisticated actors seeking to intimidate victims. The trojan also includes ransomware, so attackers can move from initial access to extortion without additional tools, and the low subscription price signals how far the barrier to entry has fallen.