Remote Access Trojan (RAT).

A Remote Access Trojan (RAT) installs a stealthy backdoor that allows an operator to view the screen, execute commands, manipulate files, log keystrokes, capture audio or video, and pivot to other systems. Unlike standard remote-administration software, a RAT is installed without consent and tries to evade detection.

Delivery and control. RATs are commonly delivered through phishing attachments, cracked software, malicious ads, drive-by downloads, or as a follow-on payload after initial compromise. Once running, the implant establishes a command-and-control (C2) channel — often over HTTPS, DNS, or a custom protocol — and beacons out to the operator, who issues interactive commands. Because the connection is initiated from inside the network, it traverses NAT and many outbound-permissive firewalls.

Named families. Gh0st RAT, whose source code leaked and remains in circulation, powered the GhostNet espionage operation uncovered in 2009 that compromised political and diplomatic targets across 103 countries. Poison Ivy (first seen 2005) was used in the 2011 breach of RSA's SecurID seed data and the follow-on Nitro campaign against chemical and defence firms. Commodity RATs such as njRAT, DarkComet, AsyncRAT, and PlugX are widely traded and repurposed by criminal and state-linked actors alike.

Defences include endpoint detection and response (EDR), application allow-listing, egress filtering with DNS and TLS inspection, blocking known C2 infrastructure, monitoring for anomalous long-lived outbound sessions, and least-privilege user accounts.

flowchart LR
  A[Phishing / cracked<br/>software / drive-by] --> B[RAT implant runs]
  B --> C[Beacon out to C2<br/>over HTTPS / DNS]
  C --> D[Operator issues commands]
  D --> E[Keylog, screen capture,<br/>file theft, webcam]
  D --> F[Lateral movement /<br/>drop more malware]
  E --> C