Group-IB Details KGB RAT Malware That Uses Jump Scares and Fake Blue Screens
Group-IB researchers have analyzed KGB RAT, a malware-as-a-service remote access trojan that steals data and cryptocurrency while using jump scares, screamers and fake blue screens. It is sold from $150 per month to $800 annually and has been marketed as legitimate software.
The malware's subscriptions start at $150 per month and reach $800 annually, according to Group-IB, which works out to about $67 per month for the annual plan. Even the cheapest package includes remote desktop access, file management, webcam and microphone access, keylogging, password recovery, endpoint persistence and anti-detection features. KGB RAT can also monitor the clipboard for copied cryptocurrency wallet addresses and replace them with addresses controlled by attackers when victims paste them.
More expensive plans add multi-client management, payload customization, additional evasion features, plugin support and access to more extensive server infrastructure. The developers also offer a separate $500 Network Spreading add-on that Group-IB says allows the malware to propagate automatically through compromised networks. Evidence of the malware's infrastructure dates back to January 2022, according to the report, though it was advertised for sale on underground forums only since late 2025, suggesting it may have been used privately before being shared more widely.
What distinguishes KGB RAT from other remote access trojans is not only its data-theft capabilities but a set of what Group-IB calls psychological harassment features. These include screamer functions, jump scares and forced blue screens of death. The developers refer to them as "fun settings," the researchers found. Group-IB said the features signal that the threat actor is "comfortable weaponizing victim anxiety alongside data theft." TechRadar noted that the report was published shortly before Halloween, when such scare tactics may appear more timely.
The malware is designed to evade detection through obfuscation, a crypter that is reportedly updated daily, sandbox detection and mechanisms for disabling or bypassing security protections. It uses a Telegram bot to notify attackers when a new device is infected and ip-api.com to determine the location of compromised endpoints. Group-IB said it identified multiple operators using the same malware builder, including at least one focused on stealing cryptocurrency from victims.
KGB RAT is also positioned as a legitimate tool, according to the report. Its website included fake customer reviews and claims that more than 10,000 IT professionals used the software, along with an education section, how-to videos and a legal section with disclaimers, warnings and notifications encouraging legitimate use. When TechRadar tried to open the site, it returned a "502 Bad Gateway" error. The report said this could mean the site was shut down, or that it was experiencing a temporary server failure or hosting problems, and it could return in the future.
Editor's Summary
Group-IB's report describes KGB RAT as a malware-as-a-service remote access trojan sold on underground forums since late 2025, offering credential theft, cryptocurrency clipboard hijacking and remote surveillance for subscriptions from $150 per month to $800 annually. The malware also includes jump scares, screamer functions and forced blue screens, which Group-IB treats as psychological harassment tools. The report says multiple operators have used the builder and that the operation markets itself as legitimate software, while its website was unavailable when TechRadar checked.