- KGB RAT is a malware-as-a-service platform offering remote access, credential theft, and crypto hijacking features
- The malware includes unusual psychological tactics such as fake BSODs, jump scares, and screamer functions
- Researchers found multiple operators using the tool, which is marketed as legitimate software despite its criminal capabilities
Halloween is just around the corner, and cybercriminals are making use of it to give Windows users a good scare (and then some!) - ater all, few things strike fear into the hearts of Windows users quite like the infamous Blue Screen of Death (BSOD), and a newly analyzed malware strain is turning that nightmare - into a weapon.
Security researchers Group-IB have published an in-depth report on KBG RAT, a newly discovered Remote Access Trojan (RAT). The malware has been advertised for sale on underground forums since late 2025, although researchers found evidence of its infrastructure dating back to January 2022. It’s quite possible that it was used privately for a little while before its developers decided to share it with the community.
KGB RAT
KGB RAT is offered as Malware-as-a-Service (MaaS), Group-IB explained, saying subscriptions start at $150 per month and reach $800 annually. The $150 package provides one month of access, while the $800 one covers the entire year, working out to roughly $67 per month for the annual subscription.
According to Group-IB, even the cheapest package includes all of the biggest features - remote desktop access, file management, webcam and microphone access, keylogging, password recovery, endpoint persistence, and different anti-detection features.
KGB RAT can also hijack cryptocurrency transactions by monitoring the clipboard for copied wallet addresses and replacing them with the ones owned by the attackers during pasting.
The more expensive plans, on the other hand, include multi-client management, payload customization, additional evasion features, plugin support, and access to more extensive server infrastructure. The unnamed developers are also offering a separate $500 Network Spreading add-on, which apparently allows the malware to propagate automatically throughout compromised networks.
Boo!
What makes this RAT stand out, however, are not its hacking features, but rather - thriller ones. In the report, Group-IB describes them as “a set of psychological harassment features”, which include screamer functions, jump scares, and forced blue screens of death. “Psychological harassment” might be a bit too harsh of a classification for a jump-scare during Halloween, but we would argue that what Microsoft did with its OS after Windows 11 could fall under that category.
KGB RAT’s developers call these features “fun settings”, the researchers discovered, while Group-IB says they’re a signal that the threat actor is “comfortable weaponizing victim anxiety alongside data theft”. Cryptocurrency theft, data exfiltration, keylogging, and remote desktop access, somehow seem to go hand-in-hand with anxiety, we believe.
The malware is designed to evade detection, using obfuscation, a reportedly daily-updated crypter, sandbox detection, and mechanisms for disabling (or simply bypassing) security protections. It uses a Telegram bot to notify the attackers when a new device becomes infected, and ip-api.com to determine where the compromised endpoint is located. The researchers said they identified multiple operators using the same malware builder, including at least one focused on stealing cryptocurrency from their victims.
Another interesting aspect of KGB RAT is that it is being positioned as a legitimate tool. Its website comes with (fake) customer reviews, and claims of being used by more than 10,000 IT professionals. It comes with an education section and different how-to videos. Ironically enough, the site was returning a “502 Bad Gateway” error when we tried to open it. While it could mean it was shut down, it can also mean a temporary server failure, or hosting problems, and it could make a comeback in the future.
While it was online, though, it contained a legal section with disclaimers, warnings and notifications encouraging users to make a legit use of their software, Group-IB found. They also included educational videos of how to install, configure, and use the software.