What is a Remote Access Trojan (RAT)?
A RAT gives attackers remote control of your device. Learn its behavior, targets, associated techniques, and how to defend.
AI Answer
A Remote Access Trojan (RAT) gives an attacker remote control of an infected device, enabling data theft, surveillance, and further compromise.
Definition
A Remote Access Trojan (RAT) is malware that provides an attacker with remote control over an infected computer, often silently.
Overview
A Remote Access Trojan (RAT) is malware that gives an attacker remote control of an infected device. Unlike a simple backdoor, RATs often include full surveillance and administrative capabilities.
Behavior
- Establishes command-and-control backdoors.
- Logs keystrokes to steal credentials.
- Captures screens, audio, and camera frames.
- Exfiltrates files and installs further payloads.
Targets
RATs target individuals, small businesses, and enterprises — often for espionage, credential theft, and financial fraud.
Defense
- Keep software patched to close initial-access vectors (e.g., SMB flaws like CVE-2017-0144).
- Use endpoint detection and response (EDR) to spot remote-control behavior.
- Restrict administrative privileges and disable unused remote-management tools.
- Monitor for unexpected outbound connections to command-and-control infrastructure.
Malware Intelligence
Family: Remote Access Trojans
Aliases: RAT, Remote Administration Tool (abused)
Techniques: T1071 Application Layer Protocol, T1059 Command and Scripting Interpreter, T1005 Data from Local System
Targets: Individuals, SMBs and enterprises (espionage), Financial and credential-bearing accounts
- Opens a backdoor for remote control
- Keylogging and credential theft
- Screen capture and webcam access
- File exfiltration and download of additional payloads