SIRIUSQTSiriusQT

SiriusQT is a commercial Windows RAT and stealer documented by Group-IB in October 2026, combining remote access, HVNC, browser automation, credential recovery, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, build-time selectable persistence (Run key, scheduled task, Startup shortcut, logon script, BootExecute) and custom stream-cipher encrypted C2 over TCP; its builder blocks CIS locales. It has been sold on dark web forums and Telegram since April 2026 as malware-as-a-service by the seller GhostKernel (lifetime licence USD 500, at least 30 valid licences sold), which Group-IB sees as a reseller that also advertises the BTMob v4.0 Android RAT. The server component names 'Amonus' as author, but Group-IB found no direct evidence linking Amonus to the tool. Cracked builds, some bundled with additional malware, spread widely on cracking forums and GitHub, and most extracted licences were leaked, so its presence does not point to a single operator. Group-IB counted more than 280 clients across campaigns (including testing and sandbox runs), mostly in the U.K., France, Germany and the Netherlands, and observed it delivered as final-stage payload by the UpCrypter loader in May 2026. No threat actor is linked here.