NjRAT-based KGB RAT, sold as a Windows admin tool, has been in development since at least 2022
Group-IB found a public reference to a KGB RAT server at version 0.1 from January 2022, years before the trojan went on sale from $150 a month. Group-IB says the "administration tool" pitch covers a surveillance and control toolkit.
The Watch · Security desk
Three advertised KGB RAT prices: a separate Network Spreading add-on at $500, which sellers claim automates spread inside a network; subscriptions from as little as $150 a month; and a one-year plan at up to $800, with lower prices for renewals.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Separate 'Network Spreading' add-on | $500 | 3 | |
| Forum price, as little as | $150 a month | 1 | |
| One-year plan, up to | $800 | lower prices for renewals | 2 |
What happened
- Public security reporting first flagged KGB RAT in September 2025 as a newly observed threat, and it drew wider attention in late 2025 as forum promotion began.
- Group-IB malware analysts Alpomish Asadov and Razvan Raducu found that KGB RAT is based on NjRAT, a widely known remote access trojan that attackers across a range of skill levels use.
- Prices top out at $800 for a one-year plan, with lower prices for renewals.
- In Group-IB's testing the trojan logged keystrokes and accessed Windows Credential Manager, and keylogging was switched on in every sample examined.
Why it matters
- What's now possible capability Forum ads claim the tool permanently disables Windows Defender and other antivirus products and works without port forwarding, a point the write-up says suits less experienced attackers. Both are the sellers' claims.
- What it costs cost The $500 Network Spreading add-on costs about 3.3 times the entry plan, so an operator who wants the sellers' automated spread inside a network pays well above the headline price.
- Who's exposed exposure Ransomware ships inside the tool. In Group-IB's view the attacker goes from access to extortion without installing anything else, so defenders lose one stage at which to catch it.
- What doesn't add up contradiction The site's legal section urges lawful use, but one forum ad tells buyers "you can hack anyone Windows easily by using this RAT." Group-IB says the developers went to great lengths to present the tool as legitimate software.
Next story · Security · 2d ago
Open staging directories and GitHub history expose UAT-6275's four-chain campaign against CIS governmentsConfirmed4 publishers
The 2022 date carries the argument. A public disclosure from late January 2022 referenced a KGB RAT server at version 0.1 [11]. Public security reporting did not flag the trojan until September 2025 [12], so more than three and a half years separate the two [17]. Group-IB says the reference indicates the developer was building and testing the tool for years before bringing it to market [11].
In our view that describes a developer who iterated on an NjRAT base over a long stretch [10]. The evidence for the early date is one 2022 reference and Group-IB's reading of it.
What a buyer gets is broad. The cheapest package already covers remote desktop, file management, camera and microphone access, keylogging, password theft, persistence and anti-detection [2]. On first contact with the command server, the malware sends the computer name, username, date, Windows version, whether the user has administrator rights and which antivirus product is installed [8]. It can also post the victim's IP address and location to a Telegram bot that notifies the operator of each new victim [8].
The intimidation side is the "fun" menu named in the Help Net Security headline. The article describes features made to frighten the person at the screen [1]. The write-up does not itemize those features, name the author of the 2022 disclosure or give a victim count.
The website presents all of this as software for IT work. It shows fake customer reviews, claims more than 10,000 IT professionals use it and offers videos on installing and configuring it [4]. "Beneath that marketing veneer, however, the advertised feature set reads as a fairly complete surveillance and control toolkit," Group-IB said [6].
The crypto-swapping module is the one feature that did not show up across the set. Only one sample had CryptoClipper enabled, with three hardcoded wallet addresses for BTC, ETH and TRC-20 [9]. Most samples Group-IB examined left it off.
What to watch
- Whether a second source or a named author corroborates the January 2022 version 0.1 server reference.
- Whether more samples or later builds ship with CryptoClipper enabled; one sample in Group-IB's set did.
- Any victim counts or attribution of the developer, which the Help Net Security write-up does not include.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−10
- Incentives60
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The trojan is advertised on hacking forums for as little as $150 a month, promises access to a victim's webcam, microphone, keystrokes and saved passwords, and comes with features made to frighten the person on the other side of the screen.
- [2]
Subscriptions start at $150 for one month and go up to $800 for one year, with lower prices for renewals; the cheapest package includes remote desktop access, file management, camera and microphone access, keylogging, password theft, persistence and anti-detection features.
- [3]
The sellers offer a separate $500 'Network Spreading' add-on that they claim automates the spread of the malware inside a compromised network.
- [4]
The KGB RAT developers went to great lengths to present the tool as legitimate software, Group-IB says: the website displays fake customer reviews, claims use by more than 10,000 IT professionals, and offers videos showing how to install, configure and use it.
- [5]
The website has an entire legal section with disclaimers whose warnings encourage buyers to use the software lawfully.
- [6]
"Beneath that marketing veneer, however, the advertised feature set reads as a fairly complete surveillance and control toolkit," Group-IB said.
- [7]
In Group-IB's testing the trojan logged keystrokes and accessed Windows Credential Manager, and keylogging was switched on in every sample examined.
- [8]
On first contact with the command server, the malware sends the computer's name, the username, the date, the Windows version, whether the user has administrator rights and which antivirus product is installed; it can also send the victim's IP address and location to a Telegram bot, notifying the operator when a new victim connects.
- [9]
Only one sample in Group-IB's set has the CryptoClipper module enabled, with three hardcoded wallet addresses for BTC, ETH and TRC-20 (Tron); the module swaps cryptocurrency wallet addresses on the clipboard for attacker-controlled ones.
- [10]
Group-IB malware analysts Alpomish Asadov and Razvan Raducu analyzed KGB RAT and found that it is built on NjRAT, a well-known remote access trojan used by attackers of varying skill.
- [11]
Group-IB researchers found a public disclosure from late January 2022 referencing a KGB RAT server at version 0.1, which they say indicates the developer had been building and testing the tool for years before bringing it to market.
- [12]
KGB RAT first showed up in public security reporting in September 2025, when a breach alert flagged it as newly observed, and received wider attention in late 2025 around the time it started being promoted on hacking forums.
- [13]
KGB RAT comes with ransomware, which in Group-IB's view lets attackers go from getting into a computer to extortion without installing anything else.
- [14]
One forum ad told buyers that "you can hack anyone Windows easily by using this RAT."
- [15]
The forum ads focused on two selling points: the claim that the tool can get past and permanently disable Windows Defender and other antivirus products, and the claim that it works without port forwarding, which makes it easier for less experienced attackers.
- [16]
The $500 Network Spreading add-on is about 3.3 times the $150 entry-level one-month plan.
- [17]
From a late January 2022 reference to the September 2025 first public reporting is about 3 years 7 to 8 months, which is more than three and a half years.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comKGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
1 article · October 15, 2026
- scworld.comKGB RAT malware uses psychological tactics to scare and steal from Windows users
1 article · October 16, 2026