Millenium RAT Rewritten in C++ for Large-Scale Campaigns

Group-IB has identified a significant architectural shift in Millenium RAT (version 4.*), moving from .NET to native C++ to eliminate framework dependencies and enhance evasion. Developed by 'ShinyEnigma' and sold under a Malware-as-a-Service (MaaS) model, the tool is currently being leveraged by a threat cluster known as Y2K Operators. This group has infected over 62,000 endpoints across 160 countries, with a dramatic surge of nearly 40,000 new infections in Q1 2026 alone.

The attack chain typically begins with social engineering lures targeting gamers, cybercrime enthusiasts, and software pirates. Technically, the RAT is distinguished by its use of the Telegram Bot API for command and control (C2), which allows malicious traffic to blend into legitimate cloud service communications. It features extensive capabilities including keylogging, browser data theft, audio/video capture, and even file encryption (ransomware) functionality.

This threat poses a substantial risk to global organizations due to its low entry cost ($50/month) and the global nature of Y2K Operators' targeting. The malware’s shift to C++ and its reliance on standard Windows API calls for most functions make it a resilient threat against traditional signature-based detection, requiring behavioral monitoring and network traffic analysis of Telegram API usage.