Millenium: A RAT Rewritten, A Threat Multiplied

Group-IB details Millenium RAT v4.*, a native C++ remote access trojan offered as low-cost MaaS by developer “shinyenigma” and used by the Y2K Operators to compromise Windows hosts worldwide (62,289 infected devices identified; 39,730 in Q1 2026). The report covers technical analysis (embedded Base64+XOR config, Telegram bot API C2, wide command set including credential theft, keylogging, screenshot/webcam, file transfer and optional encryption), distribution lures and persistence methods, mapping to MITRE ATT&CK, IOCs (URLs and file hashes), victimology, and defensive recommendations.