A remote access trojan known as Millenium RAT has been quietly spreading across the globe, and the numbers are hard to ignore. Over 62,000 devices have been compromised across more than 160 countries, with no signs of slowing down.

More than 39,000 of those infections happened in just the first quarter of 2026 alone, pointing to an operation that is actively scaling.

The malware first appeared in a threat report by CYFIRMA in November 2023, initially tracked as version 2.4. Since then, it has gone through a significant transformation.

Threat actors have moved to version 4, which carries a completely rebuilt technical foundation and a broader range of capabilities targeting Windows machines worldwide.

Analysts at Group-IB have attributed the active exploitation to a cluster they call the Y2K Operators. The malware’s developer operates under the handle “shinyenigma” and openly promotes it on underground forums and platforms like GitHub.

milleniumrat[.]online (Source - Group-IB) — milleniumrat[.]online (Source – Group-IB)

Group-IB said in a report shared with Cyber Security News (CSN) that the tool is sold as Malware-as-a-Service at $50 for the first month, $10 for renewals, or $90 for lifetime access.

The malware’s reach is not tied to any one region or industry. Victims range from everyday users to aspiring cybercriminals who unknowingly downloaded trojanised tools.

The Y2K Operators cast a wide net, using lures designed to pull in as many target groups as possible.

The sharp spike in infections during early 2026 suggests the operators are actively scaling up. With new versions still being released and a low-cost model in place, this threat is set to keep growing.

Millenium RAT Rewritten in C++

The most significant change in version 4 is its full rewrite from .NET into native C++. This removes the dependency on .NET on the victim’s machine and makes the malware harder to detect.

It communicates with operators through the Telegram Bot API, disguising command-and-control traffic as normal web activity with no dedicated server required.

Commit messages in Gitea repository (Source - Group-IB) — Commit messages in Gitea repository (Source – Group-IB)

Once executed, the RAT loads an encrypted configuration from an embedded file resource. This contains the Telegram bot token, chat ID, persistence settings, and keylogger options.

The data is Base64-encoded and protected with a custom XOR algorithm, with extra random data added to change the file hash and bypass signature-based detection.

The RAT’s capabilities are broad. It can steal browser credentials and cookies, capture screenshots and webcam images, record audio, log keystrokes, pull Telegram and Discord session data, and encrypt the victim’s files.

Operators issue all commands through Telegram without a dedicated server. Persistence is set up by copying the payload into %APPDATA% and adding a registry autorun entry.

The malware also attempts privilege escalation through a standard Windows UAC prompt, counting on the user to approve it. All functionality relies on standard Windows API calls with no zero-day exploits, meaning the operation depends entirely on user trust.

The Y2K Operators rely entirely on deception to get Millenium RAT onto victim machines. Files are disguised as credit card generators, crypto balance checkers, hacking toolkits, cracked software, and gaming utilities.

Filenames are crafted to push targets into opening them immediately, with lures spread broadly to reach as many victim types as possible.

One tactic is particularly bold. The operators take known RATs and exploit builders, silently embed a backdoor, and redistribute the tampered files.

JSON config representation (Source - Group-IB) — JSON config representation (Source – Group-IB)

A would-be attacker downloads what looks like a working tool and gets infected instead. In one campaign, victims received a shortcut disguised as a PDF, which triggered PowerShell silently and fetched a decoy document alongside the RAT payload, opening the document in the foreground as cover.

After infection, the payload blends in using names like svchost.exe, MsEdgeUpdate.exe, and Microsoft Antivirus.exe.

Users are advised to treat unexpected UAC prompts as suspicious, avoid running files from untrusted sources, use a non-administrator account for daily tasks, keep systems patched, and enable multi-factor authentication to limit damage if credentials are captured.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
URL	hxxp://158[.]94[.]208[.]168/files/8514679081/DRTjyu7[.]exe	Millenium RAT payload delivery URL
URL	hxxps://www[.]thesnapchatmodapk[.]com/update1[.]exe	Millenium RAT payload delivery URL
URL	hxxps://modedapk[.]net/update1[.]exe	Millenium RAT payload delivery URL
URL	hxxps://75877[.]mcdir[.]me/files/doc1.exe	Millenium RAT payload delivery URL (Russian PDF campaign)
URL	hxxp://kuttabilla[.]top/mr[.]exe	Millenium RAT payload delivery URL
URL	hxxp://62[.]60[.]226[.]97:5553/voshod[.]exe	Millenium RAT payload delivery URL
URL	hxxp://130[.]12[.]180[.]43/files/7924412375/upOSLDn[.]exe	Millenium RAT payload delivery URL
URL	hxxps://blackhatusa[.]com/setup[.]exe	Millenium RAT payload delivery URL
URL	hxxps://blackhatusa[.]com/clip[.]exe	Millenium RAT payload delivery URL
URL	hxxp://blackhatusa[.]com/mr[.]exe	Millenium RAT payload delivery URL
URL	hxxps://blackhatusa[.]com/update[.]exe	Millenium RAT payload delivery URL
Domain	75877[.]mcdir[.]me	Domain used to proxy Telegram Bot API requests
Domain	blackhatusa[.]com	Distribution domain for multiple RAT payloads
Domain	milleniumrat[.]online	Developer advertising/promotional website
SHA-256	1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d	Millenium RAT sample
SHA-256	2267d05dbd5e30c6dfcdde25731280dd755e689faa684bd21cfbef5281fd3e86	Millenium RAT sample
SHA-256	12b41c07299d2535f7cdc194d97496acd944a9eb5d94b8d24b19291ed9d0830c	Millenium RAT sample
SHA-256	1d52ded1f3838a1eee849ae20b2fee6c84b183cc98abe7244365b9f34b925eea	Millenium RAT sample
SHA-256	4e035575be8fe350a9e36cf29dbbc8826af2f772672bd08c9e489a243cb90e31	Millenium RAT sample
SHA-256	1c01ab1b59245f24ebdc5d9c414fcf4e2ce31f71f181522efc5a3d27476c8e21	Millenium RAT sample
SHA-256	e4496565d9fd2f9425c10a98d3a8632c12af5fe4259484cb202d7f65532b7df2	Millenium RAT sample
SHA-256	ad0f892b7b99b68491ade4949ef6b575e64d9df5f84a53019b5c1e4eeb4c46a9	Millenium RAT sample
SHA-256	ad74f502cc37e815482df49f118b2f678daf1a3f522daf07a2abeb32c2ed3831	Millenium RAT sample
SHA-256	2d8e5a2763f9a899fda44390d5b8495836c11fb266a61868d52d1f397c5243ee	Millenium RAT sample
SHA-256	cc47209d2e4d5a9b2b1d71622b0ad7f73e9c4aa56edd9aaf1e29265650c30f16	Millenium RAT sample
SHA-256	85816d89dac648645a9026973772815e956c267232b3d2577a06a43418f19ed3	Millenium RAT sample
SHA-256	92710bdb44279dbe8ccff34ba698d1558fa6d271c99ed4960ccbfb6d518d9418	Millenium RAT sample
SHA-256	a8acc24bb3e6a1a3b66a31ceaefda07d4a0e17415468683458b499f2ba240450	Millenium RAT sample
SHA-256	d55ce447e249ef9045750865fa196c8ca8434c8c484f861b7bdecbceeab7c16e	Millenium RAT sample
SHA-256	a97f15d7bfad02a600eba426c3ef72be34e944a7c8364a975c53866735f7aa4e	Millenium RAT sample
SHA-256	fc41c336b79cbc6559a17d716b84101dbef1adc5357b643a75111af442719611	Millenium RAT sample
SHA-256	5a23ca644cb1f310be1abd5f6c6a3b3e15681ced99b0947a7f3465a79aae5089	Millenium RAT sample
SHA-256	3e17ce0b30b9fd6863b341ae58ee118dc13f2ee7f1c92ac4b81c04d54480d0e0	Millenium RAT sample
SHA-256	7d8b6a64f7b65b281e7b5568929c6f96c62bbae9628162aabe7d8140a86d3de8	Millenium RAT sample
SHA-256	307964ed02f34bff4e40c5402cc936be07fd9957ef400596a4b3e2cd98c50ec1	Millenium RAT sample
SHA-256	8bef879c6920cdce7c01b8dbb7da24dca23b8822a7aa00dfc72cb32f55879a24	Millenium RAT sample
SHA-256	19e0070e5009bd5b376b9be997361d0773dcb004200ee8fafe6c14b96cbd93e4	Millenium RAT sample
SHA-256	88f9e169a85dcf6a1c03bf3ca1b1a262ed32baeca46cb87f0324adfdc098d4a2	Millenium RAT sample
SHA-256	5562246e38f8935ba8b07350e6aaa44bc22abf37b77f49836fde5999f4b61cf1	Millenium RAT sample
SHA-256	de3842bbb6626912d5b9b01fb775e1843004edb5855d4e627fd74b88bc7fe33b	Millenium RAT sample
SHA-256	ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736	Millenium RAT sample
SHA-256	8f8a71352d2f18162f2f74090dc6f0cae6b37029e3244e6522825ade75163055	Millenium RAT sample
SHA-256	57edeb575862ce8d3bff2eb4d32d9e3fa1ffb7cb8f818e2e7fc6d25a506faea6	Millenium RAT sample
SHA-256	2d5615acd1b0666995fd124fb72f2713c6609b5368350340288b52fecbdd016d	Millenium RAT sample
SHA-256	848036661c71b80ee41566918faa5eae3bf4f03ae807bb4af42cb483b6c141e2	Millenium RAT sample
SHA-256	aa2ccd18a7a09f66ca5c1bbd927f7fe411bd3874df77b0eaf40738dab7566606	Millenium RAT sample
SHA-256	a4b34b94a905fe330b0a3e4502aa45356e383a8f45ff1d008b785ea0ec14acaf	Millenium RAT sample
SHA-256	a911fe0259772906447d7e80a902ea954f3530edd9ea7d0427b6380707a8e681	Millenium RAT sample
SHA-256	7a370a9262d37de6a24706f92ff0cdded7202281a6ff3bf313721756226ebff9	Millenium RAT sample
SHA-256	66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8	Millenium RAT sample
SHA-256	512adab2c69feaf026adfb12cbd7d2eb4fee746120491e44f476eebddcbb19f2	Millenium RAT sample
SHA-256	8419b1f0acca46d45f4c54c315c8cc4784946e07d547fe55187b928fa6c6b8f5	Millenium RAT sample
SHA-256	4991873515d6dea70d7769cf67ccd8ea69184e5e454a6e6d1e093b6a3c48eb47	Millenium RAT sample
File Name	doc1.exe	Millenium RAT payload (Russian PDF lure campaign)
File Name	2.vbs	VBScript dropper used to download and execute RAT
File Name	glass_example.pdf	Decoy PDF used in Russian-language campaign
File Name	document_kp_glass.pdf	Decoy PDF written to victim’s Downloads folder
File Name	svchost.exe	Payload masquerading as Windows system process
File Name	MsEdgeUpdate.exe	Payload masquerading as Edge update process
File Name	Microsoft Antivirus.exe	Payload masquerading as antivirus software
Registry Key	HKCU\Software\Microsoft\Windows\CurrentVersion\Run	Autorun persistence entry added by Millenium RAT
Directory	%APPDATA%[install_foldername]	Persistence directory created by the RAT

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Upgrade your proactive defense against attacks. Access 5 proven threat hunting tactics you can deploy in your SOC.

The post Millenium RAT Rewritten in C++ Infects 62,000+ Devices Across 160 Countries appeared first on Cyber Security News.

Millenium RAT Rewritten in C++

Social Engineering Delivery Tactics Used by Y2K Operators