NjRAT-Based KGB RAT Sold for $150/Mo Enables Webcam Spy and Credential Theft

Attackers purchasing KGB RAT gain comprehensive remote control over infected Windows systems, including access to webcams, microphones and saved passwords. To achieve this, buyers only need to deploy the trojan, which is marketed as requiring no port forwarding and capable of disabling Windows Defender. The tool provides a complete surveillance toolkit for a low monthly fee, lowering the barrier for less experienced threat actors to conduct sophisticated intrusions against remote users.

How it unfolded

• KGB RAT first appeared in public security reporting in September 2025 as a newly observed threat.
• The malware received wider attention in late 2025 when it began being promoted on hacking forums.
• Researchers identified a public disclosure from late January 2022 referencing a version 0.1 server.

Who is affected

Windows users are the primary targets of this trojan, which is designed to operate on that operating system. The malware is sold to buyers on hacking forums who seek remote administration capabilities. According to Group-IB, the tool is marketed to individuals of varying skill levels, with features specifically designed to assist less experienced attackers by removing the need for complex network configurations like port forwarding.

The fix

No patch or official update has been confirmed to address the vulnerabilities exploited by KGB RAT. The malware relies on its own evasion techniques to persist on systems rather than exploiting a specific software bug that can be patched by a vendor. Users must rely on behavioral detection and endpoint protection measures to identify and remove the trojan, as there is no specific software update mentioned in the source material that resolves the threat.

What made it possible

Remote access trojans like KGB RAT succeed by exploiting the inherent trust granted to legitimate system administration tools. Attackers leverage this trust to bypass security controls, often using social engineering to trick users into installing the malware. The weakness lies in the difficulty of distinguishing between legitimate remote management software and malicious counterparts. Teams usually monitor for unusual outbound connections and unexpected process executions. Check whether endpoint detection systems are configured to alert on known RAT behaviors, such as unauthorized screen capturing or keylogging activity, rather than relying solely on signature-based detection.

What to do and how to stay safe: KGB RAT

• Monitor network traffic for unexpected outbound connections that may indicate command-and-control communication.
• Ensure endpoint detection and response tools are updated to recognize known remote access trojan behaviors.
• Educate users to recognize and avoid downloading software from untrusted sources or hacking forums.
• Review system logs for unauthorized remote desktop sessions or unexpected administrative privilege escalations.

Step-by-step guide: Offline Backups: Real Protection Against Ransomware and Data Loss

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the base code for KGB RAT?

KGB RAT is built on NjRAT, a well-known remote access trojan used by attackers of varying skill levels.

How much does a subscription to KGB RAT cost?

Subscriptions start at $150 for one month and go up to $800 for one year, with lower prices for renewals.

Did Group-IB find any evidence of the tool's development history?

Yes, researchers found a public disclosure from late January 2022 referencing a KGB RAT server at version 0.1.