Millenium RAT Uses Base64 and XOR Configuration to Hide Telegram C2 Settings

Gbhackers •Mayura Kathir • June 29, 2026

Millenium RAT version 4.* exposes a compact but potent evolution: the malware has migrated from .NET to native C++, while retaining a stealthy Telegram-based command-and-control (C2) model that requires no bespoke server infrastructure. The sample set and telemetry analyzed by Group-IB show the RAT embeds its entire configuration inside an RCDATA resource, masks that configuration […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Millenium RAT 4.* Enhances Stealth with Base64 and XOR Encryption Millenium RAT version 4.* has evolved from .NET to native C++, utilizing a Telegram-based command-and-control model that eliminates the need for dedicated server infrastructure. The malware embeds its configuration in an RCDATA resource, obfuscating it with Base64 and a custom XOR layer, making detection difficult. Group-IB's analysis indicates that the RAT can perform various malicious activities, including keylogging, screenshot capture, and data exfiltration, all while using standard Windows API calls. The reliance on Telegram allows for blending malicious traffic with legitimate API calls, complicating network detection efforts. The malware is distributed by a group known as the Y2K Operators, with the developer marketed as ShinyEnigma. The rapid adoption of this RAT is evidenced by telemetry showing over 62,289 infected systems. This evolution poses significant challenges for cybersecurity defenses. 2 sources 67

Millenium RAT Uses Base64 and XOR Configuration to Hide Telegram C2 Settings

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)