KGB RAT Malware Bypasses Windows Defender, Steals Credentials

Key Takeaways

• KGB RAT is a Windows remote access trojan that allows attackers to monitor systems, steal credentials, and seize control of victim desktops.
• The malware is offered as a service, advertised with “fully undetectable” capabilities against Windows Defender and other antivirus solutions.
• Researchers from Group-IB identified that KGB RAT leverages components from the known NjRAT and incorporates features like keylogging, remote control, and credential theft.
• Initial server infrastructure for KGB RAT dates back to January 2022, with active promotion on underground forums beginning in late 2025.
• The malware employs tactics such as masquerading as legitimate processes and establishing scheduled tasks for persistence, while using Telegram for infection alerts and direct command-and-control communication.

A new Windows-based remote access trojan (RAT), dubbed KGB RAT, has emerged, providing threat actors with extensive capabilities for surveillance, credential harvesting, and remote desktop control over compromised systems. This malware is being marketed as a service, with its purveyors touting a “fully undetectable” crypter designed to circumvent detection by Windows Defender and other leading antivirus products.

While the claims of undetectability warrant skepticism, a comprehensive report by Group-IB details the advertised evasion techniques and observed malicious behaviors of KGB RAT. However, the report does not definitively confirm that every variant can consistently bypass all versions of Windows Defender across diverse system configurations. The research team meticulously analyzed KGB RAT, uncovering a sophisticated toolkit that integrates credential theft, keylogging, remote desktop functionality, and even ransomware-like capabilities.

Further investigation revealed that KGB RAT operators utilize a dedicated Telegram channel for receiving real-time infection notifications, while the malware itself communicates with command-and-control (C2) servers to fetch instructions and exfiltrate data. This dual communication strategy enhances the malware’s operational stealth and resilience.

KGB RAT Malware Bypasses Windows Defender

According to Group-IB, KGB RAT began its promotion on various underground forums in late 2025. However, forensic analysis of its server infrastructure points to an earlier development timeline, with traces of an initial version dating back to January 2022. The malware operates under a “malware-as-a-service” model, allowing malicious actors to rent access to its functionalities rather than developing their own custom tools.

The service includes daily crypter updates, which are crucial for maintaining evasion capabilities against evolving security solutions. Additionally, a payload builder is provided, enabling buyers to generate malicious files in various formats, including EXE, BAT, HTA, and REG. The developers present KGB RAT as a legitimate remote administration tool, misleadingly advertising features such as file system access, webcam and microphone control, password recovery, covert desktop access, and comprehensive management tools for multiple infected machines.

Group-IB’s analysis confirmed that samples of KGB RAT are built upon an obfuscated version of NjRAT, a well-established remote access trojan. This connection is significant, indicating that KGB RAT is not an entirely novel threat but rather an enhanced commercial package leveraging existing, proven malware code. This approach allows its developers to quickly deploy a potent tool with a lower development overhead.

The research also highlights how established malware, even without groundbreaking new techniques, can pose substantial risks. For instance, a related NjRAT campaign utilized Microsoft Dev Tunnels to mask its network traffic. KGB RAT, by contrast, employs Telegram for immediate infection alerts and direct C2 connections for comprehensive remote control, demonstrating varied evasion and communication strategies.

How KGB RAT Takes Hold and Stays Active

Upon initial execution, the KGB RAT sample observed by Group-IB copied itself to a temporary directory and relaunched under the guise of svchost.exe, a common Windows process name used for masquerading. To ensure persistence, the malware then created a scheduled task named ChromeUpdate, configured to execute every time a user logs into the system. Furthermore, KGB RAT modified Windows settings, specifically those controlling the visibility of hidden system files and security zone warnings, to further conceal its presence and activities.

Before initiating its primary malicious activities, the malware performs a thorough reconnaissance of the target system. Group-IB noted that KGB RAT queried Windows Management Instrumentation (WMI) to gather detailed information about the operating system, currently running processes, and any installed security products. It also actively checked for the presence of virtual machines and analytical tools. These preliminary checks enable the malware to evade detection in sandboxed environments and tailor its actions based on the detected defensive measures.

For credential theft, the analyzed sample was observed accessing Windows Credential Manager files, which often store saved login details for various websites, network resources, and applications. Beyond credential theft, KGB RAT includes a robust keylogger to capture keyboard inputs, features for taking screenshots, monitoring clipboard content, and full remote desktop control.

A particularly insidious feature is its hidden VNC (Virtual Network Computing) capability. This allows an attacker to establish a remote viewing or control session that remains invisible to the victim on their desktop. For more information on this stealthy method, readers can refer to Cybersecurity News’ article on hidden VNC remote desktop control.

Group-IB’s analysis also revealed that KGB RAT identifies a victim’s public IP address via ip-api.com and sends immediate infection notifications through Telegram’s Bot API. One of the samples examined also featured a “Crypto Clipper” function. This module actively monitors the clipboard for copied cryptocurrency wallet addresses and, if detected, surreptitiously replaces them with an address controlled by the attacker, redirecting potential transactions.

The developers of KGB RAT aggressively market its crypter as capable of bypassing or disabling Windows Defender. A crypter’s function is to obfuscate or encrypt malware code, making it difficult for signature-based antivirus solutions to identify. However, this marketing claim does not guarantee universal evasion. Group-IB’s Malware Detonation Platform successfully detected KGB RAT samples by observing their behavioral patterns, even after obfuscation or unpacking, underscoring the importance of advanced behavioral analysis in threat detection.

This distinction is critical for cybersecurity defenders: while the malware’s file signature might change, its observable actions often remain consistent, providing tell-tale signs of compromise. In the analyzed sample, warning indicators included program execution from temporary folders, the presence of an unfamiliar ChromeUpdate scheduled task, unauthorized registry modifications, suspicious child processes, and outbound connections to Telegram or the identified C2 servers. For additional context on how RAT sellers leverage crypters and make evasion claims, a Cybersecurity News report on Silver RAT antivirus bypass methods offers further insights.

What You Should Do

• Maintain active and updated endpoint protection solutions across all systems.
• Implement strict policies to restrict the installation and execution of unapproved software.
• Configure alerts for scheduled tasks created by programs originating from user-writable directories, such as the %TEMP% folder.
• Regularly review unusual process chains and monitor outbound network connections, especially those involving Telegram or geolocation services by non-browser processes.
• In the event of a suspected infection, immediately isolate the affected device from the network.
• Preserve all relevant logs for forensic analysis and conduct investigations from a clean, trusted system.
• Promptly reset all exposed credentials and sessions following a confirmed compromise.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.