What is a Remote Access Trojan (RAT)? Attacks, Malware & Prevention

What Is a Remote Access Trojan (RAT)?

A remote access trojan (RAT) is malware that grants unauthorized remote access to a target’s device. This sophisticated threat allows attackers to control compromised systems undetected. Once installed, RATs enable malicious activities such as monitoring user behavior, extracting sensitive information, and deploying additional malware.

RATs are typically distributed through phishing schemes, malicious attachments, or compromised software updates that may initially seem legitimate. In 2023, Group-IB’s High-Tech Crime Investigation unit uncovered a phishing campaign involving fake Android apps to defraud over 4,000 victims across Southeast Asia. Singapore police alone recorded 1,899 related cases in 2023 with losses of more than USD 25 million, and 16 people were arrested in June 2024 under Operation DISTANTHILL.

Why Are Remote Access Trojans Dangerous?

RATs are dangerous because they grant attackers extensive control, turning compromised devices into gateways for data theft, espionage, and sabotage. Because RATs can disguise themselves as legitimate processes, victims often remain unaware of the intrusion until the attacker completes their objective.

The risks associated with RATs include:

• Data theft: RAT malware can steal sensitive personal data, financial details, and confidential business information.
• System manipulation: Attackers can alter settings, install additional malware, or disrupt normal operations on compromised systems.
• Surveillance: RATs let attackers monitor user activity, including keystrokes and webcam feeds, causing privacy breaches.
• Credential theft: These trojans can capture login credentials and other authentication details, facilitating further unauthorized access to accounts and systems.
• Network spread: Once inside a network, remote access trojans can infect other connected devices, amplifying the attack’s impact.
• Data corruption: Attackers can corrupt or delete critical files, causing data loss and operational disruptions.

The range of threats posed by RATs underscores the need for strong cybersecurity measures. Understanding how a RAT infiltrates and maintains control is the first step toward implementing the protections you need on your device.

How Do Remote Access Trojans Work?

Remote access trojans work like regular remote-control software, but they exploit compromised systems through various infection methods while avoiding detection. They are a common denominator in many cyberattacks and often serve as initial footholds or control mechanisms that enable further exploits (like fraud, data theft, or ransomware).

Here’s an overview of how RATs work, from the initial infection vector to their functionality and features.

1. Infection methods

Attackers use several strategies to distribute RATs and compromise systems, including:

• Phishing emails: Cybercriminals may send deceptive emails to trick recipients into opening malicious attachments or links, which can lead to RAT downloads.
• Malicious downloads: RATs can be embedded in seemingly legitimate software or files from untrustworthy sources. By downloading these, users risk infecting their devices.
• Exploit kits: Attackers use these tools to exploit software vulnerabilities, potentially installing RATs on a user’s device without their knowledge.

For example, a remote access trojan might be hidden in a software update or an email file, making the malware difficult to detect. Verify the source of any files or updates before installing them on a system.

2. Functionality and features

For RAT malware to work effectively, they come equipped with a range of features that help attackers control infected systems. These include:

• Remote control: RATs let attackers operate the victim’s computer as if they were sitting in front of it, even when miles away. They can perform many actions, such as opening files, installing software, or modifying system settings.
• Keylogging: This feature records keystrokes, allowing attackers to capture sensitive information, like account passwords.
• Screen capture: A remote access trojan can take screenshots of the target computer’s screen, potentially disclosing their activities and exposing confidential information.
• File management: With RATs, attackers can browse, upload, download, or delete files on the target system.

Unfortunately, these features also enable RATs to support malicious activities, potentially disrupting business operations and affecting victims’ lives.

3. Remote file storage

Attackers can use remote access trojans to store illegitimate content on the victim’s device. They might use the compromised system to host stolen data, illicit materials, or malware. This tactic can prevent detection and complicate investigations, potentially implicating the victim in illegal activities.

4. Spying, Blackmail, and Ransomware

RATs can access a victim’s cameras and microphones, enabling attackers to conduct covert surveillance. This capability leads to severe privacy violations and provides criminals with material for blackmail. For example, they might record private conversations or monitor personal activities to pressure the victim or their organization.

RAT infections often serve as entry points for ransomware attacks. To prevent infections from escalating into a full-blown crisis, implementing comprehensive ransomware protection solutions can help secure your organization at every stage of the attack chain by enabling rapid containment, thorough remediation, and guided recovery.

5. Distributed Denial of Service (DDoS) Attacks

In DDoS attacks, remote access trojans installed on multiple devices can be coordinated to flood a target server with overwhelming amounts of fake traffic. This illegitimate traffic disrupts or shuts down the target’s services, causing extensive damage and operational downtime. A compromised system could unknowingly become part of this malicious network, contributing to attacks on other organizations.

6. IoT and Cloud Environments

RAT capabilities have also extended into IoT and cloud environments with instances of remote shells on network appliances, surveillance systems, and cloud servers. For example, ZuoRAT is a multistage remote access trojan developed for small office/home office (SOHO) routers.

The RAT grants access to additional systems on the LAN, allowing attackers to maintain an undetected foothold. Organizations with IoT devices or cloud deployments should implement network segmentation and leverage cloud data security solutions to detect unusual remote access patterns.

Who Are The Targets Of A Remote Access Trojan (RAT)?

Targeting follows the payoff, which is why the same class of malware shows up against a single phone owner and against a national telecom operator. What separates those two cases is the timeline the operator is working to, since one wants money within the hour and the other wants quiet access that holds for years.

Retail banking customers

Android RATs aimed at bank customers have been the most active category in Southeast Asia for several years now. Group-IB’s work on Operation DISTANTHILL traced more than 4,000 people who installed fake apps, and a separate CraxsRAT campaign in Malaysia saw money leave a victim’s account within 20 minutes of installation. The banks in these cases are rarely breached themselves, yet they still absorb the fraud losses and the complaints that follow.

Telecom and critical infrastructure

Operators working for intelligence rather than profit go after networks instead of account balances. Group-IB identified Krasue running on Linux servers inside Thai telecom companies, where it had sat for roughly two years behind kernel rootkits that hid its files and its network connections from the usual tools. Telecom networks justify that patience because they carry everyone else’s traffic, so a single foothold buys visibility that would otherwise take many separate intrusions to assemble.

Ordinary businesses and their staff

Most infections aren’t aimed at any particular organization. Commodity families are sold as a service to buyers who have no target list of their own, so delivery comes down to a phishing run sent to whoever opens it, and Group-IB traced Millenium RAT across more than 160 countries working exactly that way. Smaller companies tend to feel this hardest, since one infected laptop holding saved passwords can hand over the accounts an attacker is actually after.

Types of Remote Access Trojans

Cybercriminals often reuse different types of remote access trojans, including both commercial and custom RATs. Each type has its unique features.

Here are some common types of remote access trojans, including well-established and newer variants:

• Back Orifice (1998): One of the earliest and most infamous RATs, Back Orifice allows complete control over Windows systems, making it effective in monitoring user activity, stealing data, and controlling applications. Its simplicity and power make it a favored tool among cybercriminals.
• SubSeven (1999): Favored for its ease of use and extensive range of control options, attackers use Sub7 to record audio from microphones, log keystrokes, and remotely manage files. It’s often spread through Trojanized software that unknowingly gets downloaded.
• Poison-Ivy (2005): This remote access trojan is highly regarded for its ability to perform keylogging, password stealing, and system manipulation. Poison-Ivy has been used in numerous cyber espionage campaigns, earning it the moniker “the AK-47 of cyber espionage attacks“. Its stealth makes it difficult to detect once installed on a system.
• ProRat (2006): It offers screen viewing, file access, and password-stealing features. ProRat is commonly distributed through infected email attachments or compromised downloads and often targets Windows operating systems.
• CyberGate (2010): Known for its user-friendly interface, CyberGate is popular among underground hacking circles. Its features include file transfer, keylogging, and remote desktop control. Attackers often deploy it through phishing or malicious downloads.
• VorteX RAT (2010): Another member of the RAT family, offering attackers remote desktop control, file management, and the ability to execute commands. Its stealth and persistence make it a common choice in targeted attacks.
• Agent Tesla (2014): One of the most abused commodity RATs on the market, Agent Tesla is openly sold as a legitimate remote administration tool and offers advanced keylogging and password-stealing features.
• Remcos (2016): Originally marketed as a legitimate administration tool, Remcos is now widely used as malware. Recent versions execute entirely in memory (fileless), bypassing traditional antivirus detection.
• Anubis (2017): One of the most prevalent mobile threats today, Anubis is an Android banking trojan that has evolved into a multifunction RAT. It can intercept OTPs, record audio, log keystrokes, and lock the screen with ransomware-style encryption. It spreads mainly through dropper apps, smishing links, and sideloading rather than the official app store. 
• AhMyth (2017): First released as open-source code on GitHub, AhMyth is a cross-platform Android RAT that attackers repackaged inside legitimate apps such as screen recorders, mobile games, and crypto utilities. Once installed, it persists after reboots and exfiltrates banking credentials, screenshots, and recorded audio while granting operators live access to your camera and microphone.
• AsyncRAT (2019): A NET-based RAT distributed through phishing campaigns for data theft and system compromise. AsyncRAT often uses trusted cloud platforms such as Dropbox and Cloudflare for command-and-control (C2) communication and can update itself.
• CraxsRAT (2020):  Developed from an earlier malware variant known as “Spymax,” this RAT enables complete device takeover, OTP interception, and credential theft. CraxsRAT was used in a phishing campaign that tricked victims into downloading and installing a fraudulent Android app, resulting in unauthorized fund withdrawals within minutes.
• Krasue (2023): Linux RAT utilizing cross-kernel rootkits and hiding C2 communication within RTSP protocol streams to evade network detection systems.
• StilachiRAT (2024): Features auto-reinstallation to maintain persistence, covert C2 traffic on non-standard ports such as 16000, and targeted theft of cryptocurrency wallets and browser credentials.
• Poco RAT (2024): Geo-fenced RAT targeting Spanish-speaking sectors like utilities and mining industries, distributed through phishing emails hosted on platforms like Google Drive.
• SugarGh0st (2023): Memory-resident RAT customized for espionage, particularly against U.S. organizations involved in Artificial Intelligence (AI) research. The malware is deployed in ZIP archives titled “AI Innovation Survey” or “Generative AI Policy White Paper” sent from ProtonMail addresses that impersonated AI think tanks.

According to Group-IB’s High-Tech Crime Trends Report, remote services (T1021) accounted for 23.9% of lateral movement techniques in 2024. Group-IB tracked one commodity family, Millenium RAT, across more than 62,000 compromised endpoints in over 160 countries.

These RAT families differ in how they conceal themselves, communicate externally, and escalate their access privileges. Understanding these functional differences can help you detect and defend against their unique dangers across various malicious campaigns.

Targeted Attacks and Custom RATs

While the primary purpose of remote access trojans is to provide unauthorized control over systems, custom RATs are equipped with advanced capabilities that enable fileless execution and evade cloud defenses. Threat actors often develop custom RAT malware for targeted attacks linked to espionage or data theft. In certain breaches, the malware might not match any known signature because it was custom-built and only used against a specific industry or target.

For example, the previously unknown RAT, Krasue, was used in a targeted campaign against telecom companies in Thailand. Created by the same author as the XorDdos Linux Trojan (or by someone with access to the latter’s source code), Krasue flew under the radar for two years partly because it limited its spread and used advanced tactics, such as kernel-mode rootkits and RTSP-based covert signaling.

Another example is the SugarGh0st RAT variant. Although based on a known trojan, it was modified from “Gh0stRAT” and has appeared in only a handful of campaigns targeting the AI industry. State-sponsored groups mix the two approaches, and APT33 (an Iranian state-sponsored group) was reported using commercial RATs (NanoCore RAT and PupyRAT) alongside highly specialized custom backdoors in targeted attacks.

To effectively detect emerging variants, security teams should conduct regular security audits and proactive threat hunting, rather than relying solely on threat feeds of known malware. Group-IB Security Assessment supports your security operations center (SOC) by reviewing system configurations and conducting vulnerability assessments across your infrastructure and applications. This comprehensive assessment helps uncover potential weaknesses and provides actionable strategies for hardening your defenses against advanced RATs.

Common Symptoms of RAT Malware

Common symptoms of RAT malware on your device or network include unexplained slowdowns, unfamiliar programs or processes appearing without your approval, disabled or tampered security tools, unusual spikes in outbound or cloud-service traffic, or erratic mouse or keyboard behavior that suggests remote control.

Watch out for these signs that may indicate a RAT infection on your device:

• Unusual system behavior: Unexpected pop-ups, strange system messages, or random changes in settings may signal a remote access trojan. Alerts about “suspicious background process” are also cause for concern.
• Slow performance: A compromised system may run sluggishly as the RAT consumes resources to execute malicious tasks in the background. A RAT-infected phone might exhibit battery drain, overheating, and data usage spikes because the malware is actively running and possibly transmitting data.
• Unfamiliar applications: If a user notices programs running or being installed that they don’t recognize or remember authorizing, it could signal a RAT infection. Some RATs hide their icon after installation and use innocuous names/icons (such as duplicated “Google Play Services”) to avoid raising suspicion. If an app’s icon disappears shortly after you install it, that’s another sign.
• Increased network activity: Remote access trojans often communicate with a remote server or cloud service. Unexplained spikes in internet usage or network activity could indicate their presence. Frequent upload/download traffic with Google Drive, Dropbox, Cloudflare, or Discord servers could indicate RAT C2 communication.
• Mouse or keyboard behaving erratically: If your mouse moves independently, keystrokes seem delayed, or the webcam activation indicator lights up without reason, it may indicate that an attacker is controlling your system remotely.
• Disabled security software: Some remote access trojans disable antivirus programs and firewalls, leaving the victim’s system more vulnerable.
• Strange files or messages: If a user notices unexplained files or outgoing messages from their computer, a RAT may be sending data to an unknown external source.
• Browser redirects: Some RATs install proxies or malicious browser add-ons. If webpages consistently fail to load properly and you’re redirected to unusual URLs, a RAT may be meddling with your DNS/settings.
• Suspicious administrative activities: RAT operators often perform reconnaissance and lateral movement once inside a network. Signs include the unusual use of administrative utilities such as command-line tools running at odd hours or remote desktop sessions initiated from an external IP. If a user account starts making system changes far outside their role, a RAT may be using stolen credentials.

While each symptom on its own might be due to other issues, experiencing multiple signs strongly suggests a RAT or malware infection. Multiple devices exhibiting similar symptoms can also indicate that sensitive data is at risk.

How Remote Access Trojans Evade Detection

Detection usually fails when malicious activity starts to look like ordinary system activity. Group-IB found that Krasue had been operating inside Thai telecom networks for around two years before it was identified, and the techniques below are what buy an operator that kind of time.

Obfuscation techniques

Obfuscation changes what the malware looks like on disk without changing what it does. Operators pack payloads, encrypt strings, split code across staged fragments, and lean on commercial protectors, which is enough to break signature matching even when the underlying RAT is years old. Group-IB’s analysis of Millenium RAT version 4 documented a rewrite from .NET into native C++, a change that strips out the managed-code artifacts many detection tools look for first.

Process injection

Process injection places malicious code inside a legitimate running process so the activity inherits that process’s identity and network permissions. MITRE tracks it as technique T1055 alongside a long list of sub-techniques, and the appeal for an operator is that a payload running inside a browser or a system service looks to most monitoring like the browser or the service. Catching it means watching process behavior rather than files, so unusual parent-child process pairings and unexpected memory allocations matter more than any file hash.

Persistence mechanisms

Persistence is what lets a RAT survive a reboot, and it usually relies on ordinary operating system features such as registry Run keys, scheduled tasks, services, and WMI event subscriptions. 

Some families go further. Group-IB’s analysis of RedHook documents a persistence stack that reestablishes access on Android, and Krasue loads kernel rootkits that hide its files and network connections from the tools an analyst would normally reach for. These mechanisms sit in the same places administrators legitimately work, so the useful signal is rarely the artifact itself but when it appeared and which account created it.

Living-off-the-land techniques

Living off the land means using software that is already installed and already trusted, so there is no malicious binary for a scanner to find. RAT operators run payloads through scripting hosts and signed system utilities, route command and control through Dropbox, Discord, or Cloudflare tunnels, and in some cases skip dedicated infrastructure altogether, as Millenium RAT does by taking its instructions from the Telegram Bot API. Group-IB tracked that campaign across more than 62,000 compromised endpoints in over 160 countries, without the operator ever standing up a server.

How To Protect Against Remote Access Trojans

To protect a system against RATs, organizations should keep systems fully updated, deploy multi-factor authentication (MFA) and role-based access controls, and implement continuous monitoring with endpoint detection and response (EDR) solutions.

We’ll explore these strategies and other best practices in more detail below:

1. Maintain software updates

Ensure your OS and all applications are fully updated. This is crucial for eliminating RATs, as many exploit vulnerabilities in outdated software. Regularly installing patches and updates helps close security gaps and protect against newly discovered threats.

Avoid side-loading apps or downloading them from unofficial stores. Only trust well-known developers and read reviews, as malware can sometimes slip through. Scrutinize permission requests from applications. For example, if a flashlight app asks for access to your contacts and messages, that’s a red flag.

2. Enforce Multi-Factor Authentication

MFA protects against RATs by requiring two or more verification methods before accessing an account. Even when attackers acquire login credentials through RATs, they can’t access systems without additional authentication factors.

Consider using hardware security keys or FIDO2-compliant tokens to prevent attackers from intercepting SMS-based or app-based OTP codes via RAT malware. Add verification steps when you detect unusual login activity to further reduce the risk of unauthorized access.

3. Implement least privilege and strict access controls

Limiting access to critical systems and sensitive data reduces the likelihood that a remote access trojan will infiltrate an entire network. Implementing role-based access controls (RBAC) ensures that only authorized users can access specific resources in an organization.

Applying the principle of least privilege ensures users and applications have only the permissions they need to perform their tasks. This strategy limits the potential damage when a remote access trojan compromises an account or system.

4. Monitor network traffic

Monitoring network traffic can help detect unusual activity that may indicate a remote access trojan. Use network monitoring tools and intrusion detection systems (IDS) to flag suspicious connections or data transfers. Regularly review logs and traffic patterns to identify anomalies that might point to a RAT infection.

5. Adopt zero-trust security technologies

Leveraging a zero-trust security model can reduce the risk of RAT infections. In a zero-trust environment, no device or user is trusted by default, even within the network. All access requests must pass multiple security checkpoints, such as identity verification, device compliance checks, and continuous monitoring. If a remote access trojan compromises a system, it will struggle to move laterally or escalate privileges within a network.

6. Deploy real-time monitoring and response capabilities

Modern EDR platforms can identify suspicious behaviors that traditional signature-based antivirus may overlook, such as memory-only payloads, suspicious process relationships, and unusual cloud interactions. Combine that visibility with continuous monitoring to detect and block suspicious RAT activity.

To ensure your SOC can respond effectively, consider an advanced stack like Group-IB Managed XDR. The platform integrates endpoint sensors with network analysis and real-time threat intelligence to enhance threat detection and facilitate immediate response. The platform automatically isolates compromised hosts to prevent threats from spreading further. It also reduces alert noise through automated correlation, highlighting the full attack chain in a single view and allowing your SOC personnel to focus on threats that require attention.

What to Do If You Suspect a RAT Infection

If you believe your system has been infected with a remote access trojan, you should immediately disconnect from the internet and run a full security scan. Follow these steps to contain the threat and avert further damage:

1. Disconnect from the Internet

First, block Internet access and isolate the affected host from all networks. This stops any communication between the RAT and the attacker, preventing further data transfer and remote control of your system.

If the host is a server or critical system you can’t simply unplug, consider isolating it at the switch or firewall level (quarantine VLAN or ACLs blocking all external traffic). Often, more than one host is compromised by the time you notice a RAT, so check other machines showing similar signs and isolate them as well.

2. Run a full system scan

Next, use a quality antivirus or anti-malware software to perform a comprehensive system scan. Most of these security programs can detect and quarantine remote access trojans. To be effective, make sure your security software is up to date before running the scan.

Once your SOC is alerted, they should collect relevant logs from the affected system (such as event logs or EDR alerts) and network devices. This forensic data can help investigate the attack vector and any additional compromise.

3. Assess scope and contain lateral movement

Analyze network logs, SIEM alerts, and EDR telemetry to identify any other hosts communicating with the same C2 or exhibiting similar behavior.

If the RAT used domain credentials or stolen accounts, identify those accounts and disable or reset them immediately to prevent the attacker from using them elsewhere. Consider taking critical systems offline if they show anomalies until you can scan them.

How to Remove a Remote Access Trojan

Removing a RAT is rarely a single action, because most families leave more than one way back in and will reinstall themselves from whichever component survives. The steps below work best in order, since deleting a payload before you have found its persistence points usually just buys the attacker a few hours.

1. Use antivirus or anti-malware software

Run a deep scan using trusted security software on your device. If you identify a RAT, carefully follow the software’s instructions to remove the infected files.

You can also use Task Manager or your EDR console to terminate any processes associated with the RAT malware. This stage may involve using offline malware removal tools if the RAT is deeply entrenched.

2. Check for suspicious programs and persistence mechanisms

Thoroughly review your system’s list of installed applications. If you find any unfamiliar or suspicious programs, delete them immediately. Be extra vigilant, as some RATs may disguise themselves as legitimate files.

Neutralize persistence by identifying any rogue registry Run keys, scheduled tasks, or services that were created by the malware. Some RAT variants can drop additional modules like keyloggers or maintain copies in multiple locations.

3. Manual removal (if necessary)

If you can’t eliminate remote access trojans with antivirus software, consider manual removal. This process also involves removing any backdoors or secondary malware the RAT dropped. However, exercise extreme caution, as improper manual removal can potentially harm your system more than help.

After manual removal steps, run a full system scan with an anti-malware tool in safe mode. You can also use a specialized rootkit scanner at this stage to detect advanced RATs (such as kernel-mode or Linux variants) that may hide with rootkits. Continue monitoring the system for any signs of the RAT reappearing on reboot.

4. Change all passwords

Once you’ve removed the remote access trojan, change all passwords that were used on the infected machine. Reset user account passwords and invalidate any active sessions or API keys that might have been on that host. To further secure the system and prevent reinfection, your SOC can run a threat-hunting exercise across the network using indicators of compromise (IoCs) from the RAT.

5. Seek professional help

If you’re unsure about the scope of the RAT infection or if critical systems are affected, seek the help of professional incident response services. The team can step in to ensure that the threat is fully eradicated and help you implement stronger security measures to prevent future infections.

Remember to document the incident thoroughly for any compliance or reporting needs and to refine your incident response playbooks. Speed decides the outcome here, and Group-IB’s work on a CraxsRAT campaign recorded money leaving a victim’s account within 20 minutes of the fake app being installed. Blue teams should set detection and containment targets around that window rather than a daily review cycle.

Protect Your Organization Against RATs with Group-IB

Remote access trojans pose a serious threat to your organization’s digital infrastructure. Without a robust, intelligence-driven security strategy, you risk exposing your sensitive data and critical systems to sophisticated attackers.

RATs can lead to devastating consequences: data breaches, corporate espionage, ransomware attacks, and prolonged system compromise that could cripple your operations. Preventing these scenarios requires advanced detection and incident response capabilities to help neutralize RAT threats before they impact your business.

Deploy Group-IB Managed XDR for continuous monitoring and automated threat response across your endpoints and network infrastructure. The solution is powered by Group-IB’s Threat Intelligence platform, which expands your SOC’s capabilities. With real-time data and intelligence-driven analysis of attacker tactics, techniques, and procedures (TTPs), your team can apply actionable insights tailored to your industry vertical.

Our team of elite threat hunters and reverse engineers work around the clock to dissect the latest RAT variants, ensuring your organization is always protected against emerging threats. Contact Group-IB today to schedule a demo and see how our risk engine strengthens your security program.