Remote Access Trojans (RATs)
Threat Landscape & Operational Overview
Remote Access Trojans (RATs) combine backdoor functionality with real-time interactive administrative controls. Operators utilize RAT interfaces to stream victim desktops via VNC/RDP hooks, record webcam and microphone feeds, intercept keystrokes, extract browser passwords, and execute command scripts on demand. Widely used by both cybercriminals and targeted threat groups (e.g. Remcos, AsyncRAT, QuasarRAT, NanoCore), RATs turn compromised computers into fully controlled remote nodes for reconnaissance and lateral intrusion.
🛡️ Enterprise Incident Response & Hardening Guidance
Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:
→ Open Master Guide: Backdoor & RAT Protection for BusinessesPrimary MITRE ATT&CK Tactics & Techniques
Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:
| ID | Technique | Tactic | Observed Operational Behavior |
|---|---|---|---|
T1056.001 |
Keylogging | Collection | Captures user keystrokes in real time across all open applications. |
T1125 |
Video Capture | Collection | Activates attached webcams to capture video streams of victims without consent. |
T1059.003 |
Windows Command Shell | Execution | Provides interactive command-line access to the operator console. |
T1055.012 |
Process Hollowing | Defense Evasion | Hollows legitimate Windows binaries to disguise remote RAT threads. |
T1571 |
Non-Standard Port | Command & Control | Connects to C2 servers using non-standard ports to bypass simple firewall rules. |
Actively Weaponized Exploits & Vulnerabilities (20 CVEs)
Adversaries deploying remote access trojans (rats) frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:
Microsoft Windows Server Service RPC Vulnerability (MS08-067 / Conficker)
Attributed Payloads: ircbot, sdbot, wabot
Microsoft Windows RPC DCOM Interface Buffer Overflow (Blaster Worm)
Attributed Payloads: ircbot, sdbot
Microsoft Windows PCT / SSL Handshake Buffer Overflow
Attributed Payloads: ircbot, sdbot
Microsoft Office MSCOMCTL.OCX ActiveX TreeView / ListView Buffer Overflow
Attributed Payloads: bifrost, cybergate, darkkomet +16 more
Microsoft Windows Shell Shortcut LNK / PIF Code Execution (Stuxnet)
Attributed Payloads: cybergate, hav_rat, icecold_reloaded +6 more
Microsoft Word RTF Parsing Memory Corruption (MS14-017)
Attributed Payloads: bladabindi, plugx, poison +1 more
Microsoft Windows Print Spooler Service Remote Code Execution
Attributed Payloads: ghost, hupigon, turkojan
Microsoft Office RTF pFragments Stack Buffer Overflow
Attributed Payloads: darkkomet, poison
SOC Incident Containment Checklist
Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:
- Disconnect network cabling and disable Wi-Fi to stop live interactive surveillance.
- Audit running processes for anomalous external network connections and unmapped memory pages.
- Analyze startup mechanisms including Registry Run keys, Scheduled Tasks, and Startup shortcuts.
- Inspect user accounts to verify the operator has not provisioned new local administrator accounts.
- Re-image the endpoint and conduct a credential change for all services accessed from the machine.
- Do not leave the endpoint online while investigating; the attacker may observe your remediation in real time.
- Do not enter administrative credentials on a live RAT-compromised workstation.
Prominent Malware Families in this Category
Top documented threats ranked by historical prevalence and behavioral signatures:
xtrat
Xtreme RAT (widely tracked as xtrat or xrat) is a feature-complete, commercial-grade remote access trojan that first surfaced in late 2010.
bladabindi
Bladabindi (universally recognized in the cybersecurity community as njRAT) is an infamous, widely proliferated remote access trojan orig...
nanocore
NanoCore is an extensively proliferated, modular .NET-based Remote Access Trojan (RAT) originally created in 2013 by software developer Z...
sdbot
SDBot is one of the most foundational, architecturally influential, and widely cloned IRC-controlled backdoor trojans in computer securit...
hav_rat
Hav-RAT (cataloged across antivirus software as Backdoor:Win32/HavRAT, Trojan.Win32.HavRAT, and Backdoor.HavRat) is a classic Delphi-auth...
icecold_reloaded
IceCold Reloaded (cataloged across security software as Backdoor:Win32/IceCold.Reloaded, Trojan.Win32.IceCold, and Backdoor.IceCold) is a...
wabot
Trojan:Win32/Wabot is a prolific modular botnet trojan and worm designed to compromise Windows endpoints and enlist them into large-scale...
darkkomet
DarkComet (frequently cataloged in security telemetry as DarkKomet or Backdoor.Win32.DarkKomet) is an iconic, feature-packed Remote Acces...
Complete Directory (46 Families)
Alphabetical index of all tracked malware families cataloged under remote access trojans (rats):
- apocalypse_rat
- asyncrat
- bandook
- beast
- bifrost
- bladabindi
- cometer
- cosmu
- cybergate
- darkkomet
- farfli
- gh0st
- ghost
- hav_rat
- houndhack
- hupigon
- icecold_reloaded
- immirat
- ircbot
- lost_door
- mokes
- nanobot
- nanocore
- netbus
- netwire
- netwiredrc
- njrat
- nuclear_rat
- pcclient
- plugx
- poison
- prorat
- protux
- quasar
- quasarrat
- rebhip
- recam
- remcos
- rescoms
- sdbot
- serenity_rat
- spygate
- turkojan
- wabot
- xtrat
- zegost