Group-IB Uncovers KGB RAT Malware Blending Data Theft With Jump Scares

A newly analyzed Remote Access Trojan marketed on underground forums combines standard data exfiltration capabilities with psychological harassment features designed to startle targeted users, according to research from cybersecurity firm Group-IB reported by TechRadar Pro (https://www.techradar.com/pro/security/experts-uncover-bizarre-new-malware-that-spooks-users-with-jump-scares-and-screams). The malware, identified as KGB RAT, is commercialized under a Malware-as-a-Service model and provides threat actors with administrative endpoint access alongside tools intended to induce user panic.

Group-IB's investigation revealed that access to KGB RAT is sold across tiered pricing plans, starting at $150 for a monthly subscription and $800 for an annual license, which works out to approximately $67 per month. The $150 entry package grants buyers access to an extensive assortment of operational features, including remote desktop access, local file management, stream capture from webcams and microphones, keylogging, password recovery, endpoint persistence mechanisms, and various anti-detection protections.

In addition to surveillance capabilities, the base package includes financial theft features designed to hijack cryptocurrency transactions. The software actively monitors the Windows clipboard for copied digital asset wallet addresses and replaces them with attacker-controlled addresses during pasting. Higher-priced tiers offer advanced options such as multi-client management, payload customization, additional evasion features, plugin support, and access to more extensive server infrastructure. Operators can also purchase a standalone $500 'Network Spreading' add-on that enables the trojan to propagate automatically across compromised networks.

The software's distinguishing characteristic lies in a suite of disruption features that its developers label as 'fun settings.' Group-IB documented capabilities that trigger screamer functions, visual jump scares, and forced Blue Screen of Death crashes. Researchers at Group-IB noted that these mechanisms signal that the threat actor is comfortable weaponizing victim anxiety alongside data theft and financial extraction.

To maintain persistence and evade detection, KGB RAT incorporates code obfuscation, automated sandbox detection, and routines designed to disable or bypass security protections. The developers also reportedly supply a crypter service updated daily to circumvent security signatures. Infected systems alert operators via a Telegram bot service, while relying on the ip-api.com lookup service to determine the geographic location of compromised endpoints.

Group-IB observed multiple operators utilizing identical builds of the malware builder, including at least one actor focused primarily on virtual currency theft. To market the software, the developers launched a website formatted to resemble a legitimate IT administration tool, complete with fabricated customer reviews, step-by-step instructional videos, setup guides, legal disclaimers advising legitimate usage, and claims of being used by more than 10,000 IT professionals.

Attempts by TechRadar Pro to access the showcase site returned a '502 Bad Gateway' error, indicating potential infrastructure takedowns, temporary server failures, or hosting disruptions. Group-IB's telemetry indicates that the underlying infrastructure for KGB RAT dates back to January 2022, although commercial listings for the trojan on underground forums first appeared in late 2025.