According to Tech Radar, a new malware strain named KGB RAT is weaponizing fear tactics, including fake Blue Screens of Death and jump scares, to target Windows users. This malware-as-a-service platform offers a range of malicious features.
KGB RAT is being sold on underground forums as a Malware-as-a-Service, with subscription costs ranging from $150 per month to $800 annually. Even the basic package includes remote desktop access, credential theft, keylogging, and cryptocurrency hijacking by replacing copied wallet addresses. More expensive plans offer advanced features like network propagation and payload customization. What sets KGB RAT apart are its psychological harassment features, marketed as 'fun settings' by its developers, which include fake BSODs and jump scares. Researchers from Group-IB noted that the threat actor is comfortable weaponizing victim anxiety alongside data theft. The malware employs obfuscation, daily-updated crypters, and sandbox detection to evade security measures. It uses a Telegram bot for infection notifications and ip-api.com for location tracking. Notably, KGB RAT is marketed as legitimate software with fake customer reviews and educational content, despite its criminal capabilities. Multiple operators have been identified using the same malware builder, with at least one focusing on cryptocurrency theft.
Source: Tech Radar
