Millenium: A RAT Rewritten, A Threat Multiplied | Group

Group-IB analyzes Millenium RAT version 4.*, a remote access trojan that has undergone an architectural shift from .NET to native C++, while continuing to leverage the Telegram Bot API for command and control, requiring no dedicated server infrastructure. This blog also profiles the developer “ShinyEnigma”, and threat actor cluster “Y2K Operators” responsible for active Millenium RAT exploitation campaigns. Over 62,000 compromised endpoints across more than 160 countries have been identified, with infections accelerating sharply in Q1 2026.

The Millenium RAT first surfaced in a threat report by CYFIRMA on November 3, 2023, initially tracked with malware version 2.4. Group-IB’s current intelligence suggests a significant evolution in the threat landscape, evidenced by the predominant use of version 4.* of the malware. This newer version continues to leverage a C2 architecture via Telegram bot API. As a full-featured remote access trojan, Millenium RAT 4.* is designed to compromise Windows machines. It enables threat actors to exfiltrate sensitive browser and system data, capture screenshots and audio, perform keylogging, and download and run arbitrary executables.

The malware continues to be across underground forums and even legitimate platforms like GitHub, by the developer operating under the moniker “shinyenigma”. The malware is offered as Malware-as-a-Service (MaaS) with a pricing model of $50 USD for the first month, $10 USD for subsequent months, or a one-time $90 USD lifetime purchase.

The active exploitation campaigns detailed within this blog are carried out by the threat actor cluster Group-IB tracks as the Y2K Operators, and a critical architectural shift is observed in the 4.* versions. The malware is no longer being developed using the .NET framework but is written in C++ and compiled as a native application. Analyzing our telemetry, Group-IB’s Threat Intelligence has documented a substantial number of compromised endpoints, specifically identifying 62,289 infected devices with the Millenium RAT 4.* versions. The velocity of these infections appears to have accelerated recently, with 39,730 of the total compromised devices having been infected within the first quarter of 2026 alone.

Group-IB analysts will provide a comprehensive look at the threat actor cluster, Y2K Operators, examining their methods, including the social engineering tactics they utilize to lure victims globally, and detailing the extensive victimology across affected geographies. The following sections will then break down the technical specifics of the Millenium RAT version 4.*, diving deep into its configuration loading and decryption process.

Group-IB customers can access our Threat Intelligence portal for more information this threat actor / malware.

Access free detonation reports linked to Millenium RAT and watch malware operate in real time through detailed insights from the Group-IB Malware Detonation Platform :

The developer of Millenium RAT operates under the moniker “shinyenigma” and advertises in underground forums, legitimate developer platforms like GitHub and its own website hxxps://milleniumrat[.]online.

Figure 1. hxxps://milleniumrat[.]online

Through the course of this research, the following repositories were observed to be used by ShinyEnigma to advertise Millenium RAT v4.*. However, at the time of writing, the GitHub and Gitea repositories have already been removed. It is important to note that the original commit messages in the Gitea repository were in Russian.

Figure 2. Commit messages in Gitea repository.

Millenium RAT version 4.* is built differently from the earlier versions which were written in .NET. Version 4 is written in C++ and compiled as a native application, which removes the dependency on the .NET framework. For communication, it uses libcurl to send and receive requests to the Telegram API.

Immediately after execution, the RAT loads its configuration from an embedded PE resource of type RCDATA. The resource contains Base64 encoded configuration data that is decoded at runtime. In addition to the actual configuration, the resource includes extra random Base64 data separated from the configuration by the “|” character. This additional data increases the overall size of the resource and is likely intended to alter the resulting file hash even when the core configuration remains unchanged.

In addition to Base64 encoding, the configuration is protected with a custom XOR-based algorithm. After decoding from Base64, the data is decrypted using a password embedded directly in the PE file.

Figure 5. Decrypted configuration example.

The configuration itself is stored as a plain text string, with individual fields separated by the “|” character.

Figure 6. JSON config representation.

The configuration format is a structured text string containing multiple fields:

After execution, the RAT follows the logic defined in the configuration. It either immediately sends a startup notification to Telegram or first installs itself for persistence. In the persistence scenario, it creates a directory at %APPDATA\%[install_foldername], copies itself as [install_filename], and adds an autorun entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run using the value name defined in the configuration as [start_name].

The registry key HKCU\Software\[name] is used both for storing internal data and as a semaphore. Its presence or stored values influence execution flow, allowing the malware to alter behavior depending on whether it is the first launch or a subsequent run.

The bot retrieves commands by polling the Telegram Bot API using the getUpdates method. It periodically sends HTTPS requests to the configured endpoint and parses the response to extract new messages. These messages are interpreted as commands and executed according to the implemented functionality.

Commands follow a structured text format:

The [botid] is a randomly generated four digit number created during the first execution and used as an identifier. The asterisk character is used as the field separator. The RAT parses incoming messages, verifies the [botid] value, then splits the string by the separator to extract the command name and its parameters before execution.

Although the RAT provides a wide range of features, it does not include exploits or advanced privilege bypass techniques. All functionality is implemented using standard Windows API calls. Even the attempt to obtain administrative privileges relies on the legitimate UAC prompt mechanism, assuming the user will approve the elevation request.

Figure 7: All functionality is implemented using standard Windows API calls.

Figure 8. UAC elevation example, as implemented in Millenium RAT.

Figure 9. Global victimology of Millenium RAT v4.

Figure 10. Monthly infection statistics.

Based on observed Y2K Operators campaign involving MIllenium RAT v4, initial delivery relies on compressed archives or disguised executables, with filenames chosen to entice targets into running them. The lures fall into a few recurring themes, highlighting the wide net cast by the threat actors to maximise distribution of the trojan across all industries and victim groups.

One subset of the samples observed by Group-IB in this research was especially revealing: the operators even target other cybercriminals . They take popular RATs, builders, and exploit kits, add a backdoor, and redistribute them — so the would-be attacker downloads a working tool and gets infected at the same time. CloudSEK documented the same pattern with a trojanised XWorm builder, and it remains an active distribution trend here.

In another one of the analyzed samples, the threat actors used 75877[.]mcdir[.]me domain to proxy Telegram Bot API requests. In this case, PDF lures in Russian language were observed to be dropped along with the RAT:

Once the archive is opened and execution begins, the payload itself uses a very different naming style. The goal shifts from attracting clicks to staying unnoticed on the host. Four patterns recur:

Group-IB investigation into the current iteration of Millenium RAT reveals a significant paradigm shift in its development, with the malware migrating from the .NET framework to a native C++ application. This architectural choice, combined with the continued utilization of the Telegram bot API for command and control, positions the malware as a highly resilient and formidable threat, capable of circumventing less advanced detection mechanisms.

Furthermore, the availability of the Millenium RAT as Malware-as-a-Service with low entry price drastically expands the pool of potential threat actors, allowing even less-skilled or financially constrained individuals to rapidly escalate their operations.

Given the malware developer is actively releasing new versions, we anticipate a continued commitment. Future iterations will likely prioritize the further enhancement of additional functionality and anti-forensic capabilities.

The most critical change is the architectural shift from the .NET framework to a native C++ application. This transition eliminates dependencies on the .NET framework.

Millenium RAT 4.* uses the Telegram bot API for its C2 communication. By leveraging this legitimate, cloud-based messaging platform, the malware is able to effectively mask its malicious traffic, making C2 communication blend in with normal network activity and bypass traditional filtering mechanisms.

As a full-featured Remote Access Trojan, Millenium RAT 4.* is designed to compromise Windows machines to exfiltrate sensitive browser and system data, in addition to capturing screenshots and performing persistent keylogging.

The campaign is both high-volume and global. Our telemetry has identified 62,289 unique compromised devices, with a significant acceleration observed in the first quarter of 2026 alone.

The malware is and developed by an individual operating under the moniker “shinyenigma” across underground forums and platforms like GitHub.

1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d 2267d05dbd5e30c6dfcdde25731280dd755e689faa684bd21cfbef5281fd3e86 12b41c07299d2535f7cdc194d97496acd944a9eb5d94b8d24b19291ed9d0830c 1d52ded1f3838a1eee849ae20b2fee6c84b183cc98abe7244365b9f34b925eea 4e035575be8fe350a9e36cf29dbbc8826af2f772672bd08c9e489a243cb90e31 1c01ab1b59245f24ebdc5d9c414fcf4e2ce31f71f181522efc5a3d27476c8e21 e4496565d9fd2f9425c10a98d3a8632c12af5fe4259484cb202d7f65532b7df2 ad0f892b7b99b68491ade4949ef6b575e64d9df5f84a53019b5c1e4eeb4c46a9 ad74f502cc37e815482df49f118b2f678daf1a3f522daf07a2abeb32c2ed3831 2d8e5a2763f9a899fda44390d5b8495836c11fb266a61868d52d1f397c5243ee cc47209d2e4d5a9b2b1d71622b0ad7f73e9c4aa56edd9aaf1e29265650c30f16 85816d89dac648645a9026973772815e956c267232b3d2577a06a43418f19ed3 92710bdb44279dbe8ccff34ba698d1558fa6d271c99ed4960ccbfb6d518d9418 a8acc24bb3e6a1a3b66a31ceaefda07d4a0e17415468683458b499f2ba240450 d55ce447e249ef9045750865fa196c8ca8434c8c484f861b7bdecbceeab7c16e a97f15d7bfad02a600eba426c3ef72be34e944a7c8364a975c53866735f7aa4e fc41c336b79cbc6559a17d716b84101dbef1adc5357b643a75111af442719611 5a23ca644cb1f310be1abd5f6c6a3b3e15681ced99b0947a7f3465a79aae5089 3e17ce0b30b9fd6863b341ae58ee118dc13f2ee7f1c92ac4b81c04d54480d0e0 7d8b6a64f7b65b281e7b5568929c6f96c62bbae9628162aabe7d8140a86d3de8 307964ed02f34bff4e40c5402cc936be07fd9957ef400596a4b3e2cd98c50ec1 8bef879c6920cdce7c01b8dbb7da24dca23b8822a7aa00dfc72cb32f55879a24 19e0070e5009bd5b376b9be997361d0773dcb004200ee8fafe6c14b96cbd93e4 88f9e169a85dcf6a1c03bf3ca1b1a262ed32baeca46cb87f0324adfdc098d4a2 5562246e38f8935ba8b07350e6aaa44bc22abf37b77f49836fde5999f4b61cf1 de3842bbb6626912d5b9b01fb775e1843004edb5855d4e627fd74b88bc7fe33b ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736 8f8a71352d2f18162f2f74090dc6f0cae6b37029e3244e6522825ade75163055 57edeb575862ce8d3bff2eb4d32d9e3fa1ffb7cb8f818e2e7fc6d25a506faea6 2d5615acd1b0666995fd124fb72f2713c6609b5368350340288b52fecbdd016d 848036661c71b80ee41566918faa5eae3bf4f03ae807bb4af42cb483b6c141e2 aa2ccd18a7a09f66ca5c1bbd927f7fe411bd3874df77b0eaf40738dab7566606 a4b34b94a905fe330b0a3e4502aa45356e383a8f45ff1d008b785ea0ec14acaf a911fe0259772906447d7e80a902ea954f3530edd9ea7d0427b6380707a8e681 7a370a9262d37de6a24706f92ff0cdded7202281a6ff3bf313721756226ebff9 66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8 512adab2c69feaf026adfb12cbd7d2eb4fee746120491e44f476eebddcbb19f2 8419b1f0acca46d45f4c54c315c8cc4784946e07d547fe55187b928fa6c6b8f5 4991873515d6dea70d7769cf67ccd8ea69184e5e454a6e6d1e093b6a3c48eb47

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.