Inside SiriusQT: A Seriously Skilled RAT

SiriusQT is a sophisticated Windows RAT advertised on dark web forums since April 2026, providing extensive remote access and data theft functionalities such as hidden VNC, credential and cryptocurrency wallet theft, clipboard monitoring, keylogging, and process injection. It employs custom encrypted C2 traffic and multiple process injection techniques, with both native C++ and .NET loaders. The malware is distributed via a Malware-as-a-Service model by reseller GhostKernel, with at least 30 license purchasers. The threat actor Amonus is cited as the developer, while GhostKernel manages distribution through underground forums and Telegram channels. Targeted victims are located in the UK, Germany, France, Spain, Italy, and the Netherlands.

The malware enables attackers to remotely control infected Windows systems, steal sensitive credentials and cryptocurrency wallets, monitor clipboard contents, log keystrokes, and maintain persistence through advanced process injection techniques. This can lead to significant data theft, financial loss, and unauthorized system control for affected victims.

No specific patch or official remediation is indicated for this malware. Mitigation should focus on detection and removal using updated endpoint security solutions capable of identifying SiriusQT behaviors and indicators. Network monitoring for suspicious encrypted C2 traffic and restricting unauthorized software installations can help reduce risk. Users should exercise caution with unknown downloads and links, especially from untrusted sources such as dark web forums.