Millenium RAT Uses Base64 and XOR Configuration to Hide Telegram C2 Settings

Millenium RAT version 4.* exposes a compact but potent evolution: the malware has migrated from .NET to native C++, while retaining a stealthy Telegram-based command-and-control (C2) model that requires no bespoke server infrastructure.

The sample set and telemetry analyzed by Group-IB show the RAT embeds its entire configuration inside an RCDATA resource, masks that configuration with Base64 plus a custom XOR layer using a hardcoded password, and then leverages the Telegram Bot API via libcurl to receive commands and exfiltrate data.

That combination of simple but effective obfuscation and serverless C2 makes detection and disruption more challenging for defenders who rely on conventional network indicators.

Technically, Millenium RAT 4.* reads an embedded PE resource containing a long Base64 blob; the blob includes randomized padding separated by a pipe character to intentionally change sample hashes without altering operational parameters.

After Base64 decoding, the implant applies an XOR decryption routine driven by a password string compiled into the binary.

The resulting plaintext is a pipe-delimited configuration string that supplies the Telegram token , chat ID, polling delays, persistence names and locations, keylogger settings, and dozens of feature flags.

Because the configuration is resolved entirely at runtime from an internal resource, static signature matching on the file system or network is less effective unless analysts extract and normalize the decoded config.

On execution, the native C++ RAT uses plain Windows API calls for all capabilities keylogging, screenshot and webcam capture, audio recording, browser data theft, file management, process control, and optional file encryption all invoked without kernel exploits or advanced privilege escalation.

The only elevation attempt relies on the standard UAC prompt. C2 communication is implemented through repeated HTTPS requests to the Telegram Bot API getUpdates endpoint, with messages structured using a simple separator-based format and an embedded bot identifier to associate commands.

The Millenium RAT first surfaced in a threat report by CYFIRMA on November 3, 2023, initially tracked with malware version 2.4. Group-IB’s current intelligence suggests a significant evolution in the threat landscape.

That reliance on Telegram offers operational convenience for operators: it obviates C2 hosting costs and blends malicious traffic into legitimate encrypted API calls, complicating network-based detection.

Group-IB attributes active distribution to a cluster it calls the Y2K Operators and profiles the developer “ShinyEnigma,” who markets the RAT as low-cost Malware-as-a-Service attack .

The attempt to obtain administrative privileges relies on the legitimate UAC prompt mechanism, assuming the user will approve the elevation request.

The MaaS model, aggressive advertising on underground and public code hosting platforms, and a feature-rich payload have driven fast adoption: telemetry shows 62,289 infected endpoints across more than 160 countries, with over 39,000 of those compromises occurring in Q1 2026 alone.

Delivery vectors documented include trojanized cracks, hacking tool bundles, and lures mimicking crypto and gaming utilities; several campaigns drop decoy PDFs and use chained PowerShell/VBS stagers to execute the payload silently.

Defenders should prioritize extracting and decoding embedded RCDATA resources from suspicious PE files, looking for characteristic Base64+XOR artifacts and the presence of hardcoded Telegram bot tokens or chat IDs.

Network telemetry filtering for outbound calls to Telegram API endpoints from unusual hosts, combined with endpoint guards that detect file writes to %APPDATA% install paths and autoruns under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, will help spot infections.

Given the RAT’s legitimate-API abuse, threat hunting should correlate process ancestry, unusual PowerShell/VBS execution from temporary folders, and telemetry indicating keylogger or screenshot activity.

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

A newly documented injection technique abuses the kernel-to-user callback dispatch path used by the Windows…

Dell Technologies has disclosed several critical vulnerabilities in its Wyse Management Suite (WMS) that could…

U.S. cybersecurity authorities have issued a new warning Russian intelligence-linked threat actors targeting secure…

The emergence of LLM-driven "disposable tooling" is reshaping offensive tradecraft and forcing defenders to rethink…

A critical vulnerability has been identified in Google’s Gemini CLI and the associated run-gemini-cli GitHub…

A newly disclosed remote code execution (RCE) vulnerability in Microsoft 365 Apps is raising concerns…