TL;DR Group-IB researchers analyzed more than 280 samples of the Windows SiriusQT RAT, a commercial malware family sold on dark web forums since April 2026. Offered for $500 by a reseller named GhostKernel and widely shared in cracked builds, the SiriusQT RAT merges Hidden Virtual Network Computing with a credential stealer. Furthermore, the implant uses six persistence techniques and a custom stream cipher to control infected Windows hosts.