Remote Access Trojan
Also known as: RAT
A type of malware that gives an attacker full, covert, interactive control of an infected computer — as if they were sitting at the keyboard.
Last updated:
What is a remote access trojan?
A remote access trojan, or RAT, is a category of malware that gives the attacker interactive, hands-on control of the compromised host. Unlike a worm that simply spreads, or ransomware that announces itself by encrypting files, a RAT is designed to stay hidden for weeks or months while the attacker rummages around. Typical capabilities include:
- Executing arbitrary shell commands
- Uploading and downloading files
- Logging keystrokes
- Capturing the webcam and microphone
- Taking screenshots
- Pivoting to other hosts on the internal network
How RATs differ from other malware
Generic botnet malware does one or two things — send spam, launch DDoS — with no ability for the operator to improvise. A RAT is a general-purpose remote shell, closer in spirit to a legitimate remote-administration tool like TeamViewer or SSH, except that the victim didn't install it and can't see it running. Commercial RAT families (NjRAT, DarkComet, Quasar, AsyncRAT, Remcos, DCRat) are sold or leaked on underground forums and get continuously re-skinned by low-skill attackers.
RAT network signature
RAT implants establish a persistent outbound connection to the attacker's command and control server and either hold it open or reconnect every few seconds. That long-lived outbound connection from a workstation to an unusual IP is one of the classic network indicators of a RAT infection. Checking that destination IP in an IP abuse report checker quickly confirms whether the host is associated with a known RAT family.