Group IB details SiriusQT RAT’s hidden desktop and data theft

Group-IB researchers have analysed more than 280 samples of the Windows SiriusQT RAT, a commercial malware family sold on dark-web forums since April 2026. The tool is marketed for $500 as a Malware-as-a-Service product by a reseller named GhostKernel and has circulated in cracked builds via Telegram channels and forums. The analysis shows SiriusQT merges Hidden Virtual Network Computing with a credential stealer and uses six persistence techniques, plus a custom stream cipher to control infected Windows hosts.

Group-IB notes that the campaign has included leaked Python key generators and cracked server builds bearing the window title “Sirius Cracked by Claude.”

Infection chains involve a server builder producing payloads in native x64, or packed .NET loaders, with the .NET loader decoding and loading the native SiriusQT RAT in memory. The implant implements six persistence methods, including a current-user Registry Run key, a scheduled task, a Startup folder shortcut, a UserInitMprLogonScript, a BootExecute entry, or by poisoning the default Windows user profile hive.

The HVNC component operates by pushing a reflective DLL to the victim and launching a hidden Chromium-based browser instance with spoofed or altered profiles, sending screen output as a 64-by-64 pixel tile grid back to the operator. SiriusQT’s data theft covers credentials and wallet data from Chromium profiles, cryptocurrency wallets, VPNs, FTP clients and messaging apps, with tokens from Discord also exfiltrated.

Defence guidance published alongside the report includes indicators such as the Caffee_Config resource and the SIRIUS_STUB_CONFIG marker, plus recommendations to isolate and rotate credentials if infection is confirmed.