KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs

A Windows remote access trojan called KGB RAT gives attackers a way to spy on infected computers, collect credentials and control a victim’s desktop.

The malware is sold as a service and advertised with a “fully undetectable” crypter that its sellers claim can bypass Windows Defender and other antivirus products.

That claim should be treated carefully: Group-IB’s report documents the advertised evasion and observed malicious behavior, but does not show that every version can reliably defeat Defender on every system.

Analysts and researchers from Group-IB identified and analyzed KGB RAT, finding a tool that combines credential theft, keylogging, remote control and ransomware features.

The researchers also found that its operators use a separate Telegram channel to receive infection alerts, while the malware contacts command-and-control (C2) servers for instructions.

KGB RAT Malware Bypasses Windows Defender

Group-IB said KGB RAT was promoted on underground forums from late 2025, but traces of an early version of its server infrastructure date to January 2022.

The malware is sold through a malware-as-a-service model, meaning buyers can rent access rather than build their own tool. The seller advertises daily crypter updates and a payload builder that can create files in formats including EXE, BAT, HTA and REG.

The product is presented as a legitimate remote administration tool. Its advertised features include file access, webcam and microphone control, password recovery, hidden desktop access and tools for managing multiple infected computers.

Group-IB’s analysis found samples based on an obfuscated version of NjRAT, a known remote access trojan. This connection matters because KGB RAT is not simply a new name: it builds on existing malware code and adds a commercial package around it.

The report also shows why a RAT can be dangerous even when it does not use a new technique. A related NjRAT campaign abusing Microsoft Dev Tunnels shows how familiar malware can use trusted online services to hide its network traffic. KGB RAT takes a different route, using Telegram for alerts and direct C2 connections for remote control.

In Group-IB’s tested sample, the original program copied itself into a temporary folder and relaunched as svchost.exe, a name that resembles a real Windows process.

It then created a scheduled task called ChromeUpdate to run again when a user signs in. The malware also changed a Windows setting that controls the display of hidden system files and modified a setting related to security-zone warnings.

The malware checks the computer before carrying out its work. Group-IB observed it querying Windows Management Instrumentation (WMI) for information about the operating system, running processes and installed security products.

It also checked for signs of virtual machines and analysis tools. These steps can help malware avoid running in a research sandbox or reveal which defenses are present.

How KGB RAT takes hold and stays active

For credential theft, researchers observed the sample accessing Windows Credential Manager files. These can hold saved sign-in details for websites, network resources and applications.

KGB RAT also includes a keylogger that can record keyboard activity, as well as features for screenshots, clipboard monitoring and remote desktop control.

Its hidden VNC feature is designed to give an operator a remote view or control session that may not be visible on the victim’s desktop. Readers can learn more about this method in Cybersecurity News’ article on hidden VNC remote desktop control.

Group-IB observed the malware looking up a victim’s public IP address through ip-api.com and sending an infection notification through Telegram’s Bot API.

The report also describes a Crypto Clipper feature in one analyzed sample. This type of tool watches copied cryptocurrency addresses and may replace them with an address controlled by the attacker.

KGB RAT’s sellers claim its crypter can bypass or disable Windows Defender. A crypter changes or wraps malware code to make it harder for antivirus products to recognize a file by its signature.

The seller’s claim is not proof that all builds evade protection. Group-IB says its own Malware Detonation Platform detected samples by observing their behavior, including after obfuscation or unpacking.

That distinction is useful for defenders: a file may change, but its actions can still raise alarms. In the analyzed sample, warning signs included a program running from a temporary folder, an unfamiliar ChromeUpdate task, registry changes, suspicious child processes and connections to Telegram or the listed C2 servers.

A Cybersecurity News report on Silver RAT antivirus bypass methods provides further context on how RAT sellers use crypters and other evasion claims.

Organizations should keep endpoint protection active and updated, restrict unapproved software, and alert on scheduled tasks created by programs running from user-writable folders.

Security teams should review unusual process chains and outbound connections, especially when Telegram or the listed geolocation service is contacted by a non-browser process.

If infection is suspected, isolate the device, preserve logs and investigate from a clean system before resetting exposed credentials and sessions.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs appeared first on Cyber Security News.