Full Report
Group-IB analyzes Millenium RAT version 4.*, a remote access trojan that has undergone an architectural shift from .NET to native C++, while continuing to leverage the Telegram Bot API for command and control, requiring no dedicated server infrastructure. This blog also profiles the developer “ShinyEnigma”, and threat actor cluster “Y2K Operators” responsible for active Millenium RAT exploitation campaigns. Over 62,000 compromised endpoints across more than 160 countries have been identified, with infections accelerating sharply in Q1 2026.
Analysis Summary
# Tool/Technique: Millenium RAT (Version 4.*)
## Overview
Millenium RAT is a sophisticated Remote Access Trojan (RAT) that has evolved from a .NET-based architecture to native C++. It is designed for unauthorized remote control of victim endpoints, data exfiltration, and surveillance. A defining characteristic of this malware is its serverless Command and Control (C2) architecture, which exclusively leverages the Telegram Bot API for receiving commands and exfiltrating data, eliminating the need for traditional dedicated C2 server infrastructure.
## Technical Details
- **Type:** Malware Family (Remote Access Trojan)
- **Platform:** Windows (Native C++)
- **Capabilities:** Persistence, Information Theft, Surveillance, Remote Shell, Serverless C2.
- **First Seen:** Version 4.* activity accelerated sharply in Q1 2026.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0011 - Command and Control]**
- [T1102.002 - Web Service: Bidirectional Communication (Telegram Bot API)]
- **[TA0009 - Collection]**
- [T1113 - Screen Capture]
- [T1056.001 - Input Capture: Keylogging]
- [T1123 - Audio Capture]
- [T1125 - Video Capture]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Serverless Command and Control:** Utilizes Telegram bots to relay instructions and receive stolen data, making infrastructure detection and takedowns more difficult.
- **Information Stealing:** Harvesting browser credentials, cookies, and system metadata.
- **Persistence:** Establishes automated execution upon system boot or user login to maintain access.
- **Remote Execution:** Ability to run arbitrary commands via a remote shell.
### Advanced Features
- **Architectural Shift:** Transitioned to native C++ to improve performance, reduce dependencies (like .NET Framework requirements), and increase difficulty for static analysis.
- **Multimedia Surveillance:** Capturing live audio, webcam feeds, and real-time screenshots of the victim's desktop.
- **High Scalability:** Capable of managing massive infection campaigns, evidenced by over 62,000 compromised endpoints.
## Indicators of Compromise
### File Hashes (SHA256)
*Note: A selection of identified hashes from the report.*
- `88f9e169a85dcf6a1c03bf3ca1b1a262ed32baeca46cb87f0324adfdc098d4a2`
- `5562246e38f8935ba8b07350e6aaa44bc22abf37b77f49836fde5999f4b61cf1`
- `de3842bbb6626912d5b9b01fb775e1843004edb5855d4e627fd74b88bc7fe33b`
- `ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736`
- `8f8a71352d2f18162f2f74090dc6f0cae6b37029e3244e6522825ade75163055`
- `57edeb575862ce8d3bff2eb4d32d9e3fa1ffb7cb8f818e2e7fc6d25a506faea6`
### Network Indicators
- `api[.]telegram[.]org` (Abused legitimate API endpoint)
### Behavioral Indicators
- Unexpected outbound HTTPS traffic to Telegram API from non-messaging applications.
- Creation of new Registry Run keys pointing to binaries in `AppData` or `Temp` directories.
- Unauthorized activation of webcam or microphone processes.
## Associated Threat Actors
- **Developer:** “ShinyEnigma”
- **Operator Cluster:** “Y2K Operators”
## Detection Methods
- **Signature-based detection:** Deploy the provided SHA256 hashes into EDR and AV solutions.
- **Behavioral detection:** Monitor for processes attempting to access sensitive files (browser databases) while simultaneously communicating with Telegram API ranges.
- **Network Monitoring:** Alert on high volumes of data being sent to `api[.]telegram[.]org` from workstations that do not officially use the Telegram desktop client.
## Mitigation Strategies
- **API Restriction:** If Telegram is not a business requirement, block `api[.]telegram[.]org` at the perimeter firewall or web proxy.
- **Endpoint Hardening:** Implement GPOs to restrict execution from `AppData` and `Temp` folders (Software Restriction Policies or AppLocker).
- **Least Privilege:** Ensure users do not run with administrative privileges to limit the impact of persistence mechanisms.
## Related Tools/Techniques
- **TeleGRAB / Telegram-based Stealers:** Other malware families that abuse the Telegram API for data exfiltration.
- **Native C++ Refactoring:** A common trend among malware authors to evade managed-code (.NET/Java) detection engines.