Millenium: A RAT Rewritten, A Threat Multiplied

Group-IB analyzes Millenium RAT version 4.*, a remote access trojan that has undergone significant architectural changes from .NET to native C++, while continuing to leverage Telegram Bot API for command and control without requiring dedicated server infrastructure. The malware is distributed as Malware-as-a-Service by developer 'ShinyEnigma' for $50-90 USD. Active exploitation campaigns are conducted by threat actor cluster 'Y2K Operators' using social engineering tactics including fraudulent utilities, hacking toolkits, software cracks, gaming lures, and trojanized cybercrime tools. The trojan enables exfiltration of sensitive browser and system data, screenshot and audio capture, keylogging, and arbitrary executable downloads. Over 62,000 compromised endpoints across more than 160 countries have been identified, with 39,730 infections occurring in Q1 2026 alone, demonstrating accelerating infection rates.

• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• Illegal Streaming Fronts a $7M Dropcatch Domain OperationMalware2026-08-13
• Still Circling: Toolkit Keeps EvolvingMalware2026-07-18
• Investigating Abuse of Remote Desktop and Bulk Mailing AppsMalware2026-10-29
• KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and TerrorizeMalware2026-10-15