KGB RAT Windows trojan sells webcam spying from $150 a month

A remote access trojan for Windows called KGB RAT is being sold on hacking forums by subscription. Buyers get access to a victim's webcam, microphone, keystrokes and saved passwords. The package also includes a menu of features meant to scare the person using the infected computer.

Group-IB malware analysts Alpomish Asadov and Razvan Raducu examined the tool. They found it is based on NjRAT, a well-known remote access trojan used by attackers with a wide range of skill levels.

Years in the making

KGB RAT first appeared in public security reporting in September 2025, when a breach alert listed it as a newly observed threat. It drew more attention in late 2025, when it began to be advertised on hacking forums.

The researchers also found a public disclosure from late January 2022 that mentions a KGB RAT server at version 0.1. In their view, this shows the developer spent years building and testing the tool before selling it.

The seller's website presents KGB RAT as a Windows administration product. "The website markets KGB RAT as an advanced Windows administration tool, leading with headline claims of complete Windows control, military-grade encryption, 100% Fully Undetectable (FUD) technology, advanced monitoring, Telegram alerts, and daily updates. Beneath that marketing veneer, however, the advertised feature set reads as a fairly complete surveillance and control toolkit," Group-IB explained.

The site shows fake customer reviews and claims more than 10,000 IT professionals use the software. It also offers how-to videos for installation, setup and use. "There's even an entire legal section with disclaimers," Group-IB noted. The text in that section tells buyers to use the software lawfully.

The forum ads were far less careful. One told buyers that "you can hack anyone Windows easily by using this RAT." The ads pushed two main selling points. The first is the claim that the trojan can bypass and permanently disable Windows Defender and other antivirus products. The second is that it works without port forwarding, which lowers the bar for inexperienced attackers.

Subscription tiers and add-ons

Prices range from $150 for one month to $800 for one year, with discounts on renewals. The entry-level plan covers remote desktop access, file management, camera and microphone access, keylogging, password theft, persistence and anti-detection features.

The more expensive plans let operators manage several infected machines at once. They also add payload customization, more evasion options, plugin support and access to more servers.

A separate "Network Spreading" add-on costs $500, and the sellers say it automates spreading the malware inside a compromised network. KGB RAT also ships with ransomware. Group-IB says this lets an attacker go from initial access to extortion without installing any other tools.

"The pricing gives an idea of how low the entry barrier can be," the researchers said.

What the trojan collects

Advertised features include a hidden remote desktop session that the victim cannot see, plus control of the screen, mouse and keyboard. In Group-IB's tests, the trojan recorded keystrokes and accessed Windows Credential Manager, where Windows stores login details for websites, network resources and applications. Keylogging was enabled in every sample the team looked at.

When it first contacts its command server, the malware reports the computer name, username, date, Windows version, whether the user has admin rights and which antivirus is installed. It then queries an IP geolocation service to get the victim's public IP, country, region, city, provider and approximate coordinates. It can send this data to a Telegram bot, so the operator is alerted when a new victim comes online.

A CryptoClipper module watches the clipboard for cryptocurrency wallet addresses and replaces them with addresses the attacker controls. "Only one sample has the CryptoClipper module enabled, with three hardcoded wallet addresses for BTC, ETH, and TRC-20 (Tron). This makes it the most financially motivated sample in the set and likely targets a different victim profile," Group-IB said.

Screamers and forced crashes

A menu labeled "Extra" contains what the developers call "fun settings." These let the operator play scream sounds, show jump scares and crash the computer.

"The harassment and psychological distress features - screamer functions, forced blue screens, and what the developers label 'fun settings' - are less common in RAT tooling at this capability level," Group-IB stated. The researchers believe this points to a customer base that mixes profit-driven criminals with less skilled actors who want to disrupt or intimidate victims.

Hiding in plain sight

In testing, the trojan copied itself to the temporary folder as svchost.exe, the name of a standard Windows process. It created a scheduled task called ChromeUpdate that runs it at every login with the highest privileges available. It also changed Windows settings to hide protected system files and to skip security checks when programs launch. On first run, it can show a fake error message about missing or corrupted files.

The malware also tries to avoid analysis. One sample stopped if the motherboard model matched names such as "Sandbox," "Test" or "Virtual Machine." Another looked for tools such as Wireshark, Process Explorer and dnSpy. Part of the malware also paused for 600 seconds, which is longer than the 60 to 300 seconds most automated analysis systems usually run.

Our Take

KGB RAT is not technically new. It sits on top of NjRAT, and its persistence and evasion tricks are familiar. What stands out is the packaging. Tiered plans, tutorials, a legal disclaimer page and paid add-ons make it look like a commercial product, and that lowers the skill needed to run a full intrusion that ends in ransomware.

This fits a wider pattern of ready-made crimeware aimed at buyers with little expertise, from password-stealing malware to tools that drain cryptocurrency wallets. For defenders, scheduled tasks posing as Chrome updates and svchost.exe running from a temp folder are clear signs to look for. It is worth watching whether the "Network Spreading" add-on shows up in real intrusions, and whether the "fun" features attract a new group of operators driven by harassment rather than profit.