Cybersecurity specialists at Group-IB have reported the discovery of the KGB RAT trojan, which stands out among similar malware not only for its classic set of data-theft functions, but also for tools designed to exert psychological pressure on the victim. According to researchers, the program displays frightening images to the user of the infected computer and forcibly triggers the Windows «blue screen of death» — a state that normally appears only during a fatal operating system crash. Thus, the attackers utilize both technical and emotional channels of impact, exploiting the victim's anxious state in parallel with extracting confidential information.
Psychological Impact as a Built-In Feature
The developers of KGB RAT describe the psychological impact tools in the product's description as «funny settings», but it is precisely these features that make the malware notable in its class. In addition to sudden appearances of frightening visual effects and images, the trojan is capable of forcibly initiating the «blue screen of death», simulating a critical system failure. According to experts, this indicates that the program's operators purposefully use fear and victim disorientation as an additional control mechanism, complementing traditional data theft and device hijacking.
Distribution Model and Pricing Structure
KGB RAT is distributed under the «malware-as-a-service» (MaaS) model: attackers purchase access to a builder via a subscription, which ranges from $150 per month to $800 per year. The most affordable tier includes remote desktop access, file management, webcam and microphone access, keylogging, password recovery, system persistence, and defense evasion mechanisms. Notably, the trojan monitors the clipboard contents and can substitute the user's cryptocurrency wallet addresses with those controlled by the attackers when data is pasted. More expensive packages add multi-client management, payload customization, additional stealth mechanisms, plugin support, and access to server infrastructure, while a separate network propagation module is offered for $500.
Defense Evasion Mechanisms and Operator Notifications
The malware is designed with detection avoidance in mind: it employs obfuscation methods, a daily updated crypter to hide code, mechanisms to detect sandboxes (threat analysis environments), and tools to disable or bypass security systems. A Telegram bot notifies operators about the infection of a new computer, and a legitimate service is used to determine the victim's location. According to Group-IB, the malware builder is used by several different operators, with at least one of them specializing in cryptocurrency theft.
Marketing «Legalization» and Timeline
A notable feature of KGB RAT is the attempt to present it as a legitimate tool: the product website features presumably fictional customer reviews, claims that the program is used by more than 10,000 IT specialists, and provides training materials, video tutorials, a disclaimer page, and a call to use the program only for lawful purposes. The malware has been sold on forums since late 2025, but traces of its infrastructure date back to early 2022, indicating a likely transition from private use to availability for a broad circle of attackers.
