Millenium RAT Windows malware activity and native C++ rewrite
Malware Activity
Summary
Hide ▲
Show ▼
The Millenium RAT malware activity is spreading across Windows systems, with 60,000+ infections in 160+ countries and a newer native C++ build that helps it evade weaker detection tools.
Related Happenings
Trojanized Pyrogram forks with hidden Telegram backdoor
Malware Activity
H score14
First: 01.07.2026 00:02
Last: 01.07.2026 00:02
Sources 1
About this happening:
Trojanized Pyrogram forks on PyPI now ship a hidden backdoor that gives attackers remote command execution and file access on compromised Telegram bot servers. The mal...
Trojanized Pyrogram forks with hidden Telegram backdoor
Malware ActivityAbout this happening: Trojanized Pyrogram forks on PyPI now ship a hidden backdoor that gives attackers remote command execution and file access on compromised Telegram bot servers. The mal...
Y2K Operators Millenium RAT social-engineering distribution campaign
Campaign
H score73
First: 29.06.2026 17:30
Last: 29.06.2026 17:30
Sources 1
How related:
The Y2K Operators lean on social engineering, spreading the trojan through booby-trapped downloads disguised as game cheats, cracked software and hacking tools.
About this happening:
The Y2K Operators are running a social-engineering distribution campaign that spreads Millenium RAT through booby-trapped downloads, exposing users to remote compr...
Y2K Operators Millenium RAT social-engineering distribution campaign
CampaignHow related: The Y2K Operators lean on social engineering, spreading the trojan through booby-trapped downloads disguised as game cheats, cracked software and hacking tools.
About this happening: The Y2K Operators are running a social-engineering distribution campaign that spreads Millenium RAT through booby-trapped downloads, exposing users to remote compr...
SprySOCKS Windows backdoor activity against government organizations
Malware Activity
H score23
First: 16.06.2026 12:00
Last: 16.06.2026 12:00
Sources 1
About this happening:
SprySOCKS now has documented Windows variants, WIN_DRV and WIN_PLUS, expanding a toolset first known as a Linux-only backdoor. The activity is tied to govern...
SprySOCKS Windows backdoor activity against government organizations
Malware ActivityAbout this happening: SprySOCKS now has documented Windows variants, WIN_DRV and WIN_PLUS, expanding a toolset first known as a Linux-only backdoor. The activity is tied to govern...
VENON Rust-based banking malware targeting Brazilian Windows users
Malware Activity
H score20
First: 12.03.2026 19:31
Last: 12.03.2026 19:31
Sources 1
About this happening:
Researchers disclosed VENON, a new Rust-based banking malware aimed at Brazilian Windows users, raising the risk of credential theft through fake banking overlays....
VENON Rust-based banking malware targeting Brazilian Windows users
Malware ActivityAbout this happening: Researchers disclosed VENON, a new Rust-based banking malware aimed at Brazilian Windows users, raising the risk of credential theft through fake banking overlays....
Remcos RAT runtime decryption and dynamic API loading analysis
Technical Analysis
H score23
First: 19.02.2026 18:30
Last: 19.02.2026 18:30
Sources 1
About this happening:
A newly observed Remcos RAT variant now uses runtime decryption and dynamic Windows API loading to reduce detection and frustrate static analysis on Windows systems*...
Remcos RAT runtime decryption and dynamic API loading analysis
Technical AnalysisAbout this happening: A newly observed Remcos RAT variant now uses runtime decryption and dynamic Windows API loading to reduce detection and frustrate static analysis on Windows systems*...
Timeline
-
29.06.2026 17:30 2 articles · 16d ago
Group-IB analyzes Millenium RAT’s native C++ rewrite and Telegram command flow
Technical Analysis UpdateGroup-IB describes Millenium RAT as a Telegram-controlled malware-as-a-service backdoor targeting Windows devices, and says version four rewrites the malware from the .NET framework to native C++ while using libcurl and the Telegram Bot API to receive commands without dedicated infrastructure. The analysis also attributes the campaign to Y2K Operators, reports 62,289 infections across more than 160 countries with most activity in the first three months of 2026, and notes that Millenium RAT first appeared in 2023.
Show sources
- Telegram-Based Millenium RAT Campaign Infects 60,000 Devices — www.infosecurity-magazine.com — 29.06.2026 17:30
- Telegram-Based Millenium RAT Campaign Infects 60,000 Devices — www.infosecurity-magazine.com — 29.06.2026 17:30