KGB RAT Malware Uses NjRAT Code and Crypter to Bypass Windows Defender

Group-IB researchers have identified KGB RAT as a remote access trojan that leverages an obfuscated version of the known NjRAT malware to infect Windows systems. This finding aligns with earlier reporting by Threat Times on October 15, 2026, which noted that KGB RAT uses a crypter to bypass Defender in new malware campaigns.

The malware operates as a malware-as-a-service product, allowing attackers to rent access rather than develop their own tools. Sellers advertise a "fully undetectable" crypter that they claim can bypass Windows Defender and other antivirus solutions. Group-IB cautions that while the evasion is advertised, their report does not confirm that every version reliably defeats Defender on all systems.

Technical Analysis and Infrastructure

Group-IB analysts determined that KGB RAT is not merely a renamed tool but builds on existing NjRAT code with added commercial features. The malware includes credential theft, keylogging, remote control, and ransomware capabilities. It is promoted on underground forums, with traces of its server infrastructure dating back to January 2022.

In tested samples, the malware copies itself into a temporary folder and relaunches as svchost.exe to mimic a legitimate Windows process. It then creates a scheduled task named ChromeUpdate to ensure persistence by running again when a user signs in. The tool contacts command-and-control servers for instructions while using a separate Telegram channel to send infection alerts to operators.

Malware-as-a-Service Model

The KGB RAT is marketed as a legitimate remote administration tool, featuring file access, webcam and microphone control, and password recovery. Sellers offer daily updates to the crypter and a payload builder that creates files in EXE, BAT, HTA, and REG formats. This model lowers the barrier to entry for attackers who wish to manage multiple infected computers without building custom malware.

Unlike related NjRAT campaigns that abuse Microsoft Dev Tunnels to hide network traffic, KGB RAT relies on direct command-and-control connections. This approach highlights how familiar malware can remain dangerous even without novel techniques. The use of Telegram for alerts allows operators to receive real-time notifications of successful infections while maintaining remote control through dedicated servers.

What should you do?

Organizations should monitor for suspicious scheduled tasks and processes masquerading as legitimate Windows services. Security teams should review network logs for unusual connections to command-and-control servers or Telegram-based alert systems. Users should remain vigilant against executable files delivered via common formats like EXE, BAT, or HTA.

What to do and how to stay safe: KGB RAT

• Monitor endpoint protection logs for processes named svchost.exe running from temporary directories or unexpected locations.
• Inspect scheduled tasks for entries named ChromeUpdate or similar names that trigger on user login.
• Review network traffic for connections to known command-and-control servers or unusual Telegram-related activity.
• Educate users to avoid executing files in formats such as BAT, HTA, or REG from untrusted sources.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is KGB RAT?

KGB RAT is a remote access trojan sold as a service that uses an obfuscated version of NjRAT code to steal credentials and control Windows computers.

How does KGB RAT evade detection?

Sellers advertise a crypter that they claim can bypass Windows Defender and other antivirus products, though Group-IB notes this is not guaranteed on all systems.

What persistence mechanism does KGB RAT use?

The malware creates a scheduled task called ChromeUpdate to run again when a user signs in, ensuring it remains active on the infected system.