Evolution of Millenium RAT: From .NET to Native C++ and Telegram-Based C2

The threat landscape surrounding Millenium RAT has undergone a significant technical shift. Recent observations of version 4.* reveal a more potent, streamlined evolution: the malware has migrated from its original .NET framework to native C++. While this change enhances performance and reduces its footprint, it retains its signature stealthy Command-and-Control (C2) architecture by leveraging the Telegram Bot API. This approach allows the malware to operate without the need for bespoke, easily identifiable server infrastructure.

Detailed telemetry and sample analysis provided by Group-IB indicate that the implant embeds its entire operational configuration within an RCDATA resource. To evade automated scanning, this configuration is masked using a combination of Base64 encoding and a custom XOR layer driven by a hardcoded password. Once decoded, the malware utilizes libcurl to communicate with Telegram, making its malicious traffic blend seamlessly with legitimate HTTPS requests.

This synergy of lightweight obfuscation and “serverless” C2 creates a significant hurdle for defenders. Traditional network security tools often struggle to distinguish between a user checking a Telegram message and a RAT exfiltrating stolen data via the same API endpoint.

Technical Deep Dive: Obfuscation and Runtime Configuration

Technically, Millenium RAT 4.* functions by reading an embedded Portable Executable (PE) resource containing a substantial Base64-encoded blob. To circumvent signature-based detection and vary the file’s cryptographic hash, the developers have implemented randomized padding separated by pipe characters. This ensures that even if the operational parameters remain identical, the file hash changes frequently.

The decryption workflow is straightforward but effective:

• Decoding: The implant performs Base64 decoding on the resource blob.
• Decryption: An XOR routine is applied using a password string compiled directly into the binary.
• Parsing: The resulting plaintext is a pipe-delimited string that defines the bot’s entire operational logic, including the Telegram token, chat ID, polling intervals, persistence mechanisms, and feature flags for keylogging and data theft.

Because this configuration is resolved entirely at runtime from an internal resource, static analysis on the file system is often insufficient unless an analyst successfully extracts and normalizes the decoded string.

Upon execution, the native C++ implant utilizes standard Windows API calls to facilitate its payload capabilities. These include keylogging, screenshot and webcam capture, audio recording, browser credential theft, and file management. Notably, the RAT does not rely on complex kernel exploits for these tasks; instead, it performs lateral movement and data collection through standard user-mode operations. Any attempt to gain administrative privileges relies on the legitimate User Account Control (UAC) prompt, banking on social engineering to trick the user into granting elevation.

The Rise of Malware-as-a-Service (MaaS)

The Millenium RAT first appeared in November 2023 (version 2.4) as reported by CYFIRMA, but the current iteration marks a professionalization of the tool. Group-IB attributes the active distribution to a cluster known as the “Y2K Operators,” targeting users via a developer nicknamed “ShinyEnigma.”

The developer markets the RAT as a low-cost Malware-as-a-Service (MaaS) product. This business model has fueled rapid, global adoption. Recent telemetry shows a staggering 62,289 infected endpoints across more than 160 countries, with a massive surge of over 39,000 compromises occurring in the first quarter of 2026 alone.

Delivery vectors are diverse, frequently utilizing trojanized software cracks, hacking tool bundles, and social engineering lures disguised as cryptocurrency or gaming utilities. Many campaigns employ a multi-stage execution chain, using PowerShell or VBScript stagers to silently drop the final payload.

Defensive Strategies and Threat Hunting

To effectively combat Millenium RAT, defenders should shift from basic signature matching to behavioral and heuristic analysis. Recommended actions include:

• Resource Analysis: Prioritize the extraction and decoding of RCDATA resources from suspicious PE files to identify Base64+XOR patterns and hardcoded Telegram identifiers.
• Network Monitoring: Filter outbound HTTPS traffic for unusual or high-frequency calls to the Telegram Bot API (getUpdates endpoint) coming from non-standard host processes.
• Endpoint Protection: Monitor for unauthorized file writes to %APPDATA% and suspicious entries in the Windows Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
• Process Correlation: Hunt for unusual process ancestry, specifically PowerShell or VBScript execution originating from temporary directories or user download folders.

Indicators of Compromise (IOCs)

Note: For safety and to prevent accidental triggering, all domains and IP addresses have been formatted with [.] as a placeholder for the standard dot. These indicators are provided strictly for security research and defensive analysis.