A remote access trojan (RAT) is malware that gives an attacker hidden, full remote control of an infected computer. Like any trojan horse, it usually arrives disguised as something harmless. Once running, it connects back to the attacker and waits for commands.

How it works

• The RAT is delivered through phishing attachments, fake software or bundled downloads.
• It sets up persistence so it starts again after a reboot.
• It opens a command-and-control channel, often disguised as normal web traffic (MITRE ATT&CK TA0011).
• The attacker can browse files, take screenshots, log keystrokes, use the webcam and install more tools.

Attackers also abuse legitimate remote support software in the same way. MITRE ATT&CK covers this under T1219, Remote Access Tools, noting that such tools can provide an interactive session or a backup way into a network.

Why it matters for defenders

A RAT gives an attacker a live foothold for data theft, keylogging and lateral movement. Many RATs also steal saved credentials, which can later appear in criminal markets. Endpoint protection, control over which remote tools are allowed and monitoring of outbound connections help detect them. Infected machines are sometimes also sold as access, so they connect to the wider trade in stolen logins.

Sources: MITRE ATT&CK TA0011: Command and Control, MITRE ATT&CK T1219: Remote Access Tools