Executive Summary
In October 2026, researchers detailed KGB RAT, a sophisticated Remote Access Trojan sold on the dark web. The malware operates as a Malware-as-a-Service (MaaS) offering with a focus on evading signature-based detection through daily crypter updates. It combines traditional spying features like keylogging and screen capture with disruptive psychological harassment features such as forced Blue Screens of Death (BSOD) and audio 'screamers'.
Technically, the malware leverages legitimate services for operational infrastructure, including the Telegram Bot API for command-and-control (C2) notifications and ip-api[.]com for victim geolocation. It demonstrates advanced persistence through scheduled tasks masquerading as legitimate updates and employs anti-analysis techniques to detect virtual machine environments. A notable variant also includes a CryptoClipper module designed for financial theft by intercepting and modifying cryptocurrency wallet addresses in the system clipboard.
The accessibility of this builder to multiple operators increases the risk to retail and hospitality sectors. The inclusion of ransomware and psychological harassment modules suggests that actors using KGB RAT may engage in both data theft and active disruption of business operations.