Last seven days
- First activity
- Jul 19, 2026
- Last activity
- Jul 20, 2026
- Feed role
- Distribution
- Host form
- 0 IP / 5 hostnames
Observed infrastructure
Leading locations
- DE2
- NL1
- RU1
- US1
Leading providers
- OVH SAS2
- Cloudflare, Inc.1
- GTHost1
- VDSka hosting1
Infrastructure traits
- Hosting 5
- Anycast 1
Samples
Recent associated samples
e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad Observed Jul 20, 2026Triage
2a9d31506a0ab4733d6e5993e495a7a1929daf7d9de845fc3c124447bc43a722 Observed Jul 19, 2026Triage
63e779df2c4821beca329fe9322053a1de1dba4c0e63cb3d569ffc09bbf34267 Observed Jul 19, 2026Triage
748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030 Observed Jul 19, 2026Triage
Reported operators
Threat actors
1 named in public reportingMillenium RAT v4 is a C++-based Remote Access Trojan (RAT) offered as a Malware-as-a-Service (MaaS) by the developer ShinyEnigma and actively deployed by the Y2K Operators threat cluster.
MITRE ATT&CK
Millenium RAT in ATT&CK
21 distinct techniquesTechniques
21 techniques T1195 Supply Chain Compromise T1204.002 Malicious File T1123 Audio Capture T1548.002 Bypass User Account Control T1547.001 Registry Run Keys / Startup Folder T1204 User Execution T1071 Application Layer Protocol T1059.001 PowerShell T1027 Obfuscated Files or Information T1547 Boot or Logon Autostart Execution T1555 Credentials from Password Stores T1113 Screen Capture T1056.001 Keylogging T1125 Video Capture T1071.001 Web Protocols T1539 Steal Web Session Cookie T1486 Data Encrypted for Impact T1555.003 Credentials from Web Browsers T1027.009 Embedded Payloads T1105 Ingress Tool Transfer T1036 Masquerading
