Experts uncover bizarre new malware that spooks users with jump scares and screams
As if Windows 11 wasn't scary enough on its own.
A new malware strain, dubbed KGB RAT, is making waves in the cybersecurity world with its unusual psychological tactics designed to spook Windows users. The Remote Access Trojan (RAT) is being marketed as legitimate software despite its criminal capabilities, and researchers from Group-IB have uncovered its eerie features just in time for Halloween season.
KGB RAT is offered as Malware-as-a-Service (MaaS), with subscriptions starting at $150 per month and reaching up to $800 annually. The cheaper package includes essential features such as remote desktop access, file management, webcam and microphone access, keylogging, password recovery, endpoint persistence, and anti-detection features. More expensive plans offer additional perks like multi-client management, payload customization, enhanced evasion techniques, plugin support, and access to a larger server infrastructure.
What sets KGB RAT apart from other malware is its psychological harassment features, described by Group-IB as "a set of psychological harassment features" that include screamer functions, jump scares, and forced blue screens of death (BSOD). While the term "psychological harassment" might be overly harsh for a Halloween-themed jump scare, the developers of KGB RAT apparently consider these features "fun settings" to weaponize victim anxiety alongside data theft.
The malware is designed to evade detection through obfuscation, a daily-updated crypter, sandbox detection, and mechanisms for disabling or bypassing security protections. It uses a Telegram bot to notify attackers when a new device becomes infected and uses ip-api.com to determine the location of compromised endpoints.
Interestingly, KGB RAT is being positioned as a legitimate tool, complete with fake customer reviews, claims of usage by over 10,000 IT professionals, and an education section with how-to videos. The website even returns a "502 Bad Gateway" error when accessed, possibly indicating a temporary server failure or hosting issues.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
