Remote Access Trojans (RATs) | Major RAT Families, How They Work and How to Detect Them

What Is a Remote Access Trojan (RAT)?

A remote access trojan (RAT) is malware that gives an attacker hidden, interactive control over someone else’s computer. Once it runs, the operator can see the screen, read files, record keystrokes, and issue commands as if they were sitting at the keyboard. RATs are also a staple of botnet infrastructure: the Spamhaus Project found they accounted for 42% of the Top 20 malware families associated with botnet command-and-control activity in the second half of 2025.

Remote access trojan definition in plain English

A remote access trojan is a malicious program that quietly hands a stranger remote control of your device. It is a trojan because it arrives disguised as something harmless, such as an invoice, a cracked game, or a software installer. It is a remote access tool because, once it runs, the attacker can connect from anywhere and operate the machine. The victim usually sees nothing unusual, which is why RATs are used for long-running surveillance as well as quick theft.

RAT vs legitimate remote administration tool

The difference between a RAT and a legitimate remote administration tool is consent and concealment, not capability. Tools like Remote Desktop, AnyDesk, or TeamViewer are installed intentionally, require authentication, and usually show a visible indicator when a session is active. A RAT does the same things without the owner’s knowledge and hides its process, files, and network traffic. The line is blurry in practice. Some RATs are sold as “admin tools” with a disclaimer, and attackers regularly abuse genuine remote access software because security teams tend to trust it.

RAT vs virus, worm, backdoor and spyware

A RAT is defined by what it does, which is remote control, not by how it spreads. A virus attaches itself to files and replicates, and a worm copies itself across networks without help. A RAT normally does neither and depends on a person, a phishing email, or a loader to get it onto the machine. A backdoor is the hidden entry point, and a RAT is a full-featured backdoor with an operator interface on top. Spyware only watches and reports, while a RAT can spy and also act, so many RATs bundle spyware features alongside file management and command execution.

What “RAT” means on a PC (and why “R.A.T.” is spelled both ways)

On a computer, “RAT” stands for remote access trojan, and it is sometimes expanded as “remote administration tool” for the same category of software. “R.A.T.”, “RAT” and “remote-access trojan” all refer to the same thing. The dotted form is simply an older or more formal way of writing the initialism. It has nothing to do with rodents or computer mice. Security tools often label detections with “RAT” or a specific family name, so seeing the term in an antivirus alert means the scanner suspects remote-control malware.

What a RAT can do (screen capture, keylogging, webcam, file theft, persistence)

A RAT can capture the screen, log keystrokes, switch on the webcam and microphone, browse and steal files, and stay installed after a reboot. Most also provide a remote shell, can pull passwords from browsers, and can download further malware onto the host. Academic research on the njRAT and DarkComet families describes live spying through the camera and microphone, theft of stored data, and use of RATs for surveillance, information theft, and extortion. Persistence is what turns a single infection into an ongoing breach. A RAT that survives restarts gives the operator a standing foothold, which they can use, resell, or hand off to another attacker.

How a RAT Works: Anatomy of a Remote Access Trojan

A RAT works by planting a small hidden program on a victim’s device that calls home to an attacker’s server and then waits for commands. Most RATs have three parts: a builder that creates the malware, the stub that infects the victim, and a controller the attacker uses to operate infected machines. Every later stage of an attack, from data theft to dropping ransomware, runs through that connection.

Builder, stub and controller (client/server model)

A RAT follows a client/server model in which the victim runs the “server,” and the attacker runs the “client”. The builder is a point-and-click program where an operator enters a command-and-control address, picks features, and outputs a customized executable, called the stub or payload. The controller is the dashboard that lists connected victims and lets the operator open a shell, browse files, or watch the screen. Researchers studying njRAT and DarkComet showed how this design can be exploited: they found each sample’s controller domain, registered the expired ones, and used them to see who was still infected. That also shows why RAT infections often outlive the campaigns that created them.

Command-and-control (C2) channels and common ports

A RAT’s C2 channel is the network connection between the infected device and the operator, and it usually runs over a plain TCP socket, HTTP, or HTTPS. Many families ship with default ports, such as 5552 for njRAT, 1604 for DarkComet and 4782 for Quasar, though operators change them freely, so a port number alone is weak evidence. Newer RATs hide in normal traffic by using Telegram or Discord bots, cloud storage, dynamic DNS, or Tor. C2 infrastructure keeps growing: Spamhaus reported botnet command-and-control activity up 24% in the second half of 2025. Defenders get better results from spotting regular outbound beaconing than from blocking individual ports.

Persistence and evasion techniques

RATs stay on a machine by registering themselves to relaunch, most often through registry Run keys, scheduled tasks, startup folders, or Windows services. To avoid detection, they pack or obfuscate their code, inject into trusted processes such as explorer.exe, check for sandboxes and virtual machines, and delay execution to evade automated analysis. Some sideload a malicious DLL through a legitimate signed program, and others disable or bypass security features before running. Because RATs mimic ordinary system activity, detection depends on behavior and context more than on file signatures.

Plugins and modular functionality

Many modern RATs are modular: a lightweight core connects to the server, and extra features arrive as plugins on demand. A plugin might add a keylogger, password stealer, hidden remote desktop session, cryptominer, reverse proxy, or ransomware encryptor. Modularity keeps the first-stage file small and harder to flag, and it lets the operator switch from spying to extortion without a new infection. It is also why a single RAT detection can understate what actually ran on the machine.

Can hackers see your screen? What Access a RAT Actually Gives

Yes, if a RAT with screen capture or remote desktop is running on your device, the operator can watch your screen in real time, see what you type, and open your files. Access is limited to the infected device and whatever that user account can reach, so a RAT can’t spy on a device that has never run the malware. Webcam and microphone Access depends on the operating system’s permissions, and on macOS or mobile the user must normally approve those prompts. A RAT that has stolen saved passwords and session cookies can also reach cloud accounts and other systems that the original device was signed into. The most visible signs are a cursor moving on its own, unexplained remote sessions, or the webcam light turning on without reason.

Major RAT Families Compared (Comparison Table)

The most useful way to compare RAT families is by who builds them and who uses them. Commodity RATs are open-source or cheap tools anyone can run, while state-linked RATs are Custom or privately shared tools built for long-term espionage. The two tables below compare the main families on seven points, and the sections that follow cover each one in more depth.

RAT family comparison: origin, language, delivery and detection traits

Criminal and commodity RATs

State-linked and APT-associated RATs

First-seen years are approximate and based on public reporting. Defaults such as ports and certificate names are useful for hunting, but operators can change them with a single setting, so treat them as leads rather than proof. Behavior is more reliable than static indicators: repeated beaconing from an unexpected process, persistence in odd locations, and a signed program loading an unsigned DLL point to a RAT regardless of family.

Criminal and Commodity RATs

Criminal and commodity RATs are remote access trojans sold, leaked, or published as open source so almost anyone can run them, and they are the ones most organizations are likely to encounter. The families below run from long-lived tools such as njRAT and DarkComet to subscription products like XWorm. Their builders are cheap, and their operators are often low-skilled, which is why they are so widespread.

njRAT (Bladabindi)

njRAT, also known as Bladabindi, is a .NET remote access trojan that has circulated since around 2012 and remains one of the most commonly used RATs among low-skilled attackers. It offers keylogging, webcam and microphone Access, file management, browser credential theft, and spreads via USB drives; its plugin system lets operators add features. Its staying power comes from a leaked builder and easy-to-find tutorials. A USENIX Security study of njRAT and DarkComet used expired controller domains to count victims, measure campaign duration, and map the geographic link between attackers and victims. The study showed that a small crew of operators can keep infections going for years.

DarkComet

DarkComet is a Delphi-based RAT created in 2008 by a French developer, and it became one of the most widely abused remote administration tools of its era. The author stopped development in 2012 after it was reported to be used for surveillance of activists in the Syrian conflict, but leaked copies and cracked builders still circulate. It provides remote desktop, webcam capture, keylogging, file transfer, and a remote shell. Defaults such as TCP port 1604 and DC_MUTEX mutex names make old DarkComet samples easy to hunt for, though modern variants often change them. Today it is more often a legacy threat than a leading one.

Quasar RAT (open-source, also used by APT33)

Quasar RAT is an open-source remote administration tool written in C# and published on GitHub so that anyone can compile and modify it for free. It was built as a legitimate admin tool, but its public code has made it a regular in criminal and espionage campaigns, and APT33, an Iran-linked group, has been reported using it. Typical capabilities include remote desktop, file management, password recovery, and a reverse shell. Because attackers can rebuild it with new defaults, detection depends on behavior and certificate artifacts such as the “Quasar Server CA” name, not on a fixed signature.

XWorm (RCE flaw, plugins, ransomware modules, Telegram/Discord distribution)

XWorm is a subscription-style RAT that has become one of the most active commodity tools. An actor named XCoder developed it and shared updates on Telegram; researchers found a critical remote code execution flaw in version 5.6 and earlier. After XCoder deleted the Telegram accounts, multiple threat actors began spreading cracked copies. A new seller then resurfaced with version 6.0 and later, advertising a $500 lifetime license and a patched RCE flaw. Its design is modular, with more than 35 plugins, including a ransomware module that overlaps in code with NoCry ransomware. Distribution relies heavily on Telegram and Discord channels, and Trellix has tracked v7.x updates being pushed through a new Telegram channel and a phishing chain that abuses a WinRAR path-traversal flaw (CVE-2025-8088). Even criminals aren’t safe: CloudSEK documented a trojanized XWorm builder that stole browser credentials from the people running it.

DcRAT, AsyncRAT and VenomRAT (including the Europol/Endgame takedown)

DcRAT, AsyncRAT and VenomRAT are closely related .NET RATs built on the open-source AsyncRAT codebase, and together they cover most of the low-cost “AsyncRAT-style” market. AsyncRAT provides the base for remote desktop, keylogging, and file Access; DcRAT is a popular fork with extra plugins, and VenomRAT was sold commercially. In November 2025, Operation Endgame hit VenomRAT hard: Europol and Eurojust coordinated a takedown of 1,025 servers and 20 domains across Rhadamanthys, VenomRAT, and Elysium, and the principal VenomRAT suspect was arrested in Greece. VenomRAT sold for roughly $150 a month and typically arrived via malicious email attachments. Takedowns remove a vendor’s infrastructure, but forks of the same open-source code keep circulating.

Warzone, Orcus, Remcos and NetWire

Warzone, Orcus, Remcos, and NetWire are commercial RATs marketed to buyers, often under the guise of legitimate remote administration software. Warzone (also called AveMaria) is a C++ tool active since 2018; in February 2024, the FBI seized its main website and arrested two people, including a Malta resident accused of selling it and a Nigerian man accused of providing customer support. NetWire has been a cross-platform RAT since 2012, and in March 2023 the FBI seized its sales domain and arrested a Croatian man believed to run it. Orcus was sold as a remote administration product with features that made it clearly useful for abuse. Remcos is still sold as “remote control software”, and it remains one of the most frequently seen RATs in phishing campaigns because it is easy to buy and well supported.

Newer and niche families (Chaos, Cloud9, Neptune, Silver, Pupy, Python-based RATs)

Newer and niche RATs are mostly lightweight, open-source or forum-sold tools that target specific platforms or evade detection by being unfamiliar. Cloud9 is a good example of how far the category stretches: it is a malicious Chrome extension that behaves like a RAT, stealing cookies, logging keystrokes, and delivering second-stage payloads. It spreads through fake software update sites, not the official Chrome Web Store. Pupy is an open-source, cross-platform RAT, and because it is public on GitHub, many actors still use it, including APT groups such as APT35. Chaos, Neptune, and Silver follow the same pattern: cheap, publicly promoted tools often sold or shared through Telegram and GitHub. Python-based RATs are common because they are quick to write, easy to package into a Windows executable, and often use a Telegram or Discord bot as their C2 channel.

Mobile RATs: Android and iPhone

Mobile RATs are remote access trojans built for phones, and they are overwhelmingly an Android problem because Android lets apps be installed outside the official store. They typically work by tricking users into granting Accessibility permission, which lets the app read the screen and tap on the user’s behalf. iPhones are much harder to infect with commodity RATs, though not immune to targeted spyware.

Android RAT malware (CraxsRAT, Cipher RAT, Rafel RAT)

CraxsRAT, Cipher RAT, and Rafel RAT are the Android RATs most often seen in criminal campaigns, and they follow the same recipe of a builder, a disguised APK, and a control panel. CraxsRAT and Cipher RAT are sold as a service, and a Syria-based developer known as EVLF DEV is believed to be behind both, with at least 100 lifetime CraxsRAT licenses sold over three years. CraxsRAT can retrieve location, contacts, messages, and call logs. Its builder can pop up a customized prompt that pushes the victim into enabling Accessibility access for screen and keystroke capture. Rafel RAT is open source, and Check Point counted around 120 campaigns using it, with fake Instagram, WhatsApp, e-commerce and antivirus apps as lures. Some of those campaigns went on to lock devices and demand a ransom.

Discord-delivered and sideloaded APK threats

Most Android RATs reach victims through sideloaded APK files, app installers downloaded outside Google Play. Attackers share them through messaging apps, social media, SMS links, and fake download pages, and chat platforms such as Discord and Telegram are common places to host or pass them around. In Rafel RAT campaigns, attackers lured victims via WhatsApp, Telegram, and SMS into installing malware-laced APKs. Device age matters too: Check Point found that more than 87.5% of infected Rafel RAT devices ran Android 11 or older, versions that had reached end of life and no longer received security updates. The practical rule is that an app which asks you to enable “unknown sources” and then Accessibility access should be treated as hostile until proven otherwise.

Can an iPhone get RAT malware?

An iPhone can technically be compromised, but commodity RATs like the ones above do not run on a standard, up-to-date iPhone. iOS isolates apps from one another and only installs software through Apple-controlled routes, so the Accessibility-based trick used on Android has no direct equivalent. The realistic risks are jailbroken devices, malicious configuration profiles, and rare, expensive spyware aimed at a few individuals. Apple describes that last category, known as mercenary spyware, as among the most advanced digital threats in existence, and says it has sent threat notifications to users in over 150 countries since 2021. Apple also says it cannot detect every attack, and it recommends enabling Lockdown Mode if you suspect you are being targeted. For most people, the more likely “remote access” scam on an iPhone is social engineering, where a caller persuades the user to share their screen or hand over codes.

State-Linked and APT-Associated RATs

State-linked RATs are remote access trojans used by government-backed espionage groups to keep quiet, long-term Access to government, defense, technology, and corporate networks. They prioritize persistence and stealth over quick profit, and many have been around for over a decade. The families below are most often tied to China- and North Korea-linked operations.

PlugX and its takedown

PlugX is a modular RAT used for espionage that has been active since at least 2008, and it is most closely associated with the China-linked group Mustang Panda. It runs commands, steals files, and persists through registry changes; one variant also spreads via USB drives, which helped it reach so many machines. In January 2025, the Justice Department and FBI confirmed a court-authorized operation that deleted PlugX from more than 4,200 infected US computers, led by French authorities with help from the security firm Sekoia. French prosecutors said the malware had infected several million computers worldwide. The operation worked because Sekoia had found a built-in command that makes infected machines remove PlugX.

ShadowPad (including WSUS exploitation)

ShadowPad is a modular backdoor that first appeared in 2015 and is widely used by Chinese state-sponsored groups. It is assessed to be a successor to PlugX. In late 2025, attackers weaponized a Windows Server Update Services flaw to deliver it: AhnLab reported that attackers exploited CVE-2025-59287 for initial Access, then used certutil and curl to download and install ShadowPad. The malware relies on DLL sideloading: a legitimate executable loads a malicious DLL that runs the loader in memory. Patching WSUS and never exposing it to the internet are the key defenses.

Gh0st RAT and its derivatives

Gh0st RAT is an older Windows RAT whose source code became public around 2008, making it a base for dozens of modified versions. It was tied to the GhostNet espionage network exposed in 2009, and attackers have since reused its leaked code in both China-linked groups and by ordinary criminals. Typical features include remote shell access, screen and audio capture, keylogging, and file transfer. Because so many forks exist, detection usually relies on spotting its recognizable default network packet structure and the behavior of Custom variants, not a single signature.

Poison Ivy

Poison Ivy is a Windows RAT that has been freely available since the mid-2000s and became one of the best-known tools in Chinese espionage campaigns. It was reportedly used in the 2011 compromise of RSA and in campaigns against chemical and defense companies. It offers file access, remote shell, keylogging, audio and video capture, and password theft through a simple graphical controller. Its age and public availability made it hard to attribute, since many unrelated actors used the same builder. It is still seen occasionally, mainly in older campaigns and legacy samples.

Hiatus RAT, GolangGhost and BitStep

Hiatus RAT and GolangGhost show two very different ways that state-linked RATs are being deployed: through routers and through fake job interviews. Lumen’s Black Lotus Labs found HiatusRAT targeting end-of-life DrayTek Vigor 2960 and 3900 business routers, letting attackers download files, run commands, and set up proxy infrastructure. Its unusual feature is that it turns the compromised router into a proxy for the attacker’s traffic. GolangGhost is tied to North Korea’s Famous Chollima group, which runs fake job interview campaigns where victims paste a command to “fix” a camera error, delivering PylangGhost on Windows and GolangGhost on macOS. Cisco Talos described PylangGhost as a Python variant that is functionally similar to GolangGhost.

Why espionage RATs reuse and share tooling

Espionage groups reuse and share RATs because it is cheaper, faster, and harder to attribute than writing new malware for every operation. ShadowPad is the clearest example: SentinelOne called it a “masterpiece of privately sold malware in Chinese espionage,” meaning several groups can use the same tool. Open-source and leaked RATs add to the overlap, including Quasar and Pupy, which Iran-linked groups such as APT33 and APT35 have been reported using. For defenders, the lesson is that the family name says little about who is behind an intrusion, so behavior, infrastructure, and victim profile matter more than the malware label.

How RATs Get Delivered

RATs get onto devices through a small number of delivery routes: phishing attachments, loaders and botnets that drop them as a second stage, cracked software and fake installers, exploited vulnerabilities, and social engineering through chat platforms. The malware itself is rarely the hard part for an attacker. Getting a person or a vulnerable server to run it is, which is why most RAT defense starts with the delivery chain.

Phishing emails and malicious attachments

Phishing email remains the most common way RATs arrive, usually via an attachment or a link that triggers a multi-stage download. VenomRAT, for example, was typically delivered through malicious email attachments. The attachment is rarely the RAT itself. XWorm V6 campaigns used phishing emails with malicious JavaScript droppers that ran PowerShell to deliver injector DLLs. A 2026 XWorm v7.1 chain used a phishing email with a booby-trapped archive that exploited a WinRAR path-traversal flaw, CVE-2025-8088. Invoice, quotation, and shipping lures remain the standard themes.

Loaders and botnet-delivered payloads

Many RAT infections are second-stage payloads delivered by a loader or an existing botnet, not the first thing the victim ran. Loaders are small programs that get past defenses and fetch whatever the operator is paid to install. In pay-per-install models, a botnet sells Access to its infected machines to other criminals, and a RAT is one of the products installed. The Elysium botnet, taken down in Operation Endgame, was described as responsible for widespread malware distribution and pay-per-install operations. Researchers also saw XWorm operators use their Access to run further malware such as the Hworm VBS RAT and Remcos. To see how loader-led infections are organized, read our guide to [botnets and loaders — add internal link to botnet page].

Cracked software, fake installers and malvertising

Cracked software, fake installers and malicious ads work because victims run the file voluntarily. Attackers bundle a RAT into a pirated game, a “free” version of paid software or a fake update, then promote it through search ads, video descriptions and file-sharing sites. The Cloud9 browser RAT spread through unofficial channels, including websites advertising fake Adobe Flash Player updates. The trap also catches criminals: CloudSEK found a trojanized XWorm builder spread through GitHub repositories, file-sharing services, Telegram channels, and forums. The rule is simple: treat software from outside the vendor’s site or an official store as hostile.

Exploits, USB spread and supply-chain compromise

Exploits, USB drives, and supply-chain compromise are the main non-phishing routes, and more capable operators favor them. Attackers can compromise internet-exposed servers directly: AhnLab reported attackers exploiting the WSUS flaw CVE-2025-59287 to gain initial Access and install ShadowPad. Removable media is an older route that still works, and the FBI said the PlugX variant it removed spread through a computer’s USB port, infecting attached USB devices. Supply-chain attacks hide the RAT inside trusted software or updates, which is how ShadowPad first became widely known in 2017 after being found in compromised commercial software.

Social engineering via Discord and Telegram

Chat platforms are now both sales and delivery channels for RATs. Attackers send files or links through Discord servers, Telegram groups, and messaging apps, often posing as friends, recruiters, or support staff. Rafel RAT campaigns used WhatsApp, Telegram, and SMS to get victims to install infected APK files. North Korea’s Famous Chollima group uses fake job interviews that end with a “fix this camera error” command, which delivers the PylangGhost and GolangGhost RATs. The common thread is a plausible reason to run something, so any request to paste a command or open an unexpected file deserves a pause.

How to Detect a Remote Access Trojan

You can detect a remote access trojan by looking for three things: odd device behavior, unauthorized outbound connections, and persistence mechanisms the attacker installed. No single sign is reliable on its own, because a well-built RAT is designed to look like normal activity. Infections rarely announce themselves, and an attacker working through a RAT often resembles legitimate administrator activity. Confirming an infection usually means combining device symptoms, network data, and host evidence.

Warning signs on a device (performance, webcam light, unknown processes)

The most common signs of a RAT on a device are unexplained slowness, a webcam light or microphone indicator that turns on by itself, a cursor that moves on its own, and unfamiliar processes consuming CPU or network. Other clues include antivirus that has been switched off, new user accounts, files that have moved or vanished, and browser sessions that sign out unexpectedly. On Android, watch for apps you did not install that hold Accessibility or device-admin permission, since CraxsRAT needs Accessibility enabled to see the screen and capture keystrokes. None of these proves infection, but several together justify a closer look.

Network indicators (beaconing, odd outbound connections, C2 traffic signatures)

The strongest network sign of a RAT is beaconing: a device contacting the same external address at regular intervals. The pattern can be slow, as with HiatusRAT, which sent a heartbeat to its server every eight hours. Watch also for traffic to services that the process has no reason to use. One XWorm chain communicated with a Telegram-based command-and-control server, so a script or unknown executable calling Telegram or Discord APIs deserves attention. Other indicators are long-lived connections to unfamiliar hosts, unusual ports, dynamic DNS domains, and default certificate names. Defaults such as ports and certificate strings are worth searching for, but attackers can change them easily, so use them as leads, not proof.

Host indicators (persistence keys, scheduled tasks, dropped files)

On the host, look for the footholds a RAT needs to survive a reboot: Run and RunOnce registry keys, scheduled tasks, startup folder entries, new services, and files in AppData, Temp, or ProgramData. Persistence is common in practice: XWorm established persistence through a scheduled task, and its plugins were stored in the registry. Another strong signal is a signed legitimate program loading an unsigned DLL, as in the ShadowPad case where a legitimate executable loaded a malicious DLL that ran the loader in memory. Windows events such as new scheduled task creation (4698) and service installation (7045) make these changes visible if logging is enabled.

Using EDR, AV and RAT scanners or detectors

Endpoint detection and response (EDR) tools catch RATs best because they watch behavior, while traditional antivirus mainly matches known signatures and misses packed or freshly built samples. A RAT scanner or detector is still useful as a second opinion, and an offline scan from outside the running system is better at finding malware that hides from the live OS. Free tools such as Microsoft Defender Offline, Sysinternals Autoruns, Process Explorer, and TCPView help inspect persistence, processes, and connections. Be careful with random “RAT checker” downloads from forums, since some of them are malware themselves. A clean scan reduces suspicion but does not prove a device is safe.

Threat-hunting and detection rules for security teams

Security teams should hunt for RATs by behavior and map detections to known techniques, because family-specific signatures age quickly. Useful starting points are MITRE ATT&CK techniques for remote access software (T1219), registry Run keys (T1547.001), scheduled tasks (T1053.005), DLL sideloading (T1574.002), and web-service C2 such as Telegram (T1102). Practical hunts include Office or script hosts spawning PowerShell, certutil or curl downloading files, rare parent-child process pairs, and beacon analysis for fixed intervals. In the WSUS-delivered ShadowPad case, recommended checks included suspicious PowerShell, certutil and curl use, and blocking unwanted traffic on ports 8530 and 8531. Sigma rules cover the behaviors, YARA rules cover known families, and Suricata signatures cover default C2 patterns across the host, file, and network layers.

How to Remove a RAT and Recover

To remove a remote access trojan, disconnect the device from the network, preserve evidence, clean or rebuild the system, and then change every credential and session from a different, clean device. Removal is only half the job because the attacker may have already copied files, passwords, and session cookies. When the RAT ran with administrator rights, or you cannot confirm what it did, reinstalling the system is safer than cleaning it.

Immediate containment steps (isolate, disconnect, preserve evidence)

First, cut the device off the network by unplugging Ethernet, turning off Wi-Fi, or enabling airplane mode so the operator loses the live connection. Do not log in to email, banking, or admin accounts on the infected machine, because the operator may be watching or logging keystrokes. Before changing anything, note the time, symptoms, and any suspicious files or processes, and, in a business setting, capture memory and a disk image if your team can. This matters because some RATs live mainly in memory, like ShadowPad, which uses a legitimate program to load a malicious DLL and runs its loader in memory. Powering off or rebooting can destroy that evidence, so isolate first and decide on shutdown afterward.

Removing RAT malware step by step

Removing a RAT on Windows means getting the system into a state where the malware isn’t running, then scanning and removing what persists. The usual order is:

1. Boot into Safe Mode without networking.
2. Run an offline scan such as Microsoft Defender Offline, plus a second reputable scanner.
3. Check persistence with a tool like Sysinternals Autoruns, covering Run keys, scheduled tasks, services, and startup folders.
4. Delete the files and entries that the scan and your review identify, then reboot and scan again.
5. Review local accounts, installed remote tools, and firewall rules for anything you did not add.

Treat the result as provisional. A clean scan after removal lowers risk but does not prove the system is trustworthy, especially if the malware had modules that could have installed other tools.

Credential rotation and session invalidation after infection

After removal, assume every password, token, and session that touched the device is compromised and rotate them from a separate clean device. Start with email and password-manager accounts, then banking, cloud and work accounts. Changing a password isn’t enough on its own, because a RAT can steal browser cookies that keep a session logged in: for example, the Cloud9 extension could steal cookies that let attackers take over valid user sessions. Sign out of all devices, revoke app passwords and OAuth tokens, rotate API and SSH keys, and re-enroll multi-factor authentication. This is increasingly where attackers operate: CrowdStrike’s 2026 threat report found that 82% of detections involved no malware at all, with attackers using valid credentials and trusted identity flows instead. Credentials are the real prize, and the RAT is often just the way in.

When to reimage instead of clean

Reimage the device whenever you cannot be confident the cleanup was complete. The clearest triggers are a RAT that ran with administrator or SYSTEM rights, multiple persistence mechanisms, signs of additional payloads, and servers or machines logged into by privileged accounts. Modular families raise the stakes, since XWorm has more than 35 plugins, including a ransomware module. Reinstall from trusted media, restore only data you have checked, and patch before reconnecting. If a domain admin or other privileged account was used on the infected machine, treat the whole environment as potentially compromised and widen the investigation.

Removal differences for Windows, Android and iPhone

Windows removal depends on offline scanning and persistence cleanup, Android on revoking permissions and uninstalling or resetting, and iPhone on updating, removing profiles, and restoring if needed. On Android, switch to airplane mode, boot to Safe Mode, then revoke Accessibility and device-admin Access for unknown apps before uninstalling them. Some RATs resist this: Rafel RAT changes the device password and locks the screen if the user tries to revoke its admin privileges, which can make a factory reset through recovery mode the only option. Back up only essential data, and avoid restoring apps from the infected state. On iPhone, install the latest iOS, delete unknown configuration profiles under VPN and device management, and restore the phone if it was jailbroken or you suspect compromise. If you suspect targeted spyware, Apple advises enabling Lockdown Mode and contacting Access Now’s Digital Security Helpline.

The Dark Web Angle: RAT Builders, Access Sales and Stolen Sessions

RATs are sold, rented, and monetized on the dark web in three ways: the malware itself is sold on forums and Telegram; brokers resell the Access it creates; and the credentials and sessions it steals end up in stealer logs. For defenders, this means a RAT infection can show up outside your network long before you notice it inside. Monitoring those underground channels can provide an early warning that a device or account has already been exposed.

How RAT builders and cracked panels are sold on forums and Telegram

RAT builders are openly sold on cybercrime forums and Telegram channels, usually with a price list, update announcements, and customer support. Telegram has become the main storefront. Trellix tracked XWorm sales and found Telegram channels selling it as a high-tier commodity, with a new channel pushing v7.x updates. Cracked and leaked builders circulate in parallel, which is how a paid product ends up free. The risk runs both ways: CloudSEK found a trojanized XWorm builder spreading through GitHub repositories, file-sharing services, Telegram channels, and forums, so buyers of cracked tools are also victims. Even small tools get listed: the Cloud9 browser RAT was spotted on cybercrime forums, suggesting its operators may be selling it.

Malware-as-a-service and subscription RATs

Subscription RATs lower the barrier to entry by packaging malware, updates, and support into a monthly or lifetime plan. Prices are low enough for beginners: XWorm was advertised for a $500 lifetime subscription, and VenomRAT was marketed for about $150 a month. Mobile RATs follow the same model, as at least 100 lifetime CraxsRAT licenses were reported sold over three years. As a result, skilled operators and curious teenagers now use the same tools, so infections come from a wide mix of attackers with very different goals. Law enforcement targets the vendor side of this market, as in the Warzone and VenomRAT actions, but the ecosystem regenerates quickly.

From infection to initial access broker listings

When a RAT lands on a corporate machine, the Access it creates can be sold on to someone else through an initial access broker (IAB). IABs specialize in breaking in and then reselling the foothold, usually to ransomware affiliates. Recorded Future describes IABs gaining Access through infostealer infections, brokerage services on dark web forums, or purchased stealer logs. The market is cheap and structured: Rapid7’s 2025 Access Brokers Report found that over 70% of listings included user privileges, and nearly 40% were priced between $500 and $1,000. Ransomware affiliates such as Akira, Black Basta and Conti have been known to buy Access directly instead of carrying out the intrusion themselves. That is why a “minor” RAT infection can become a ransomware incident within days.

Stolen sessions, cookies and credentials surfacing in stealer logs

RATs and infostealers both feed stealer logs, which are bundles of everything valuable taken from an infected device. Infostealer malware extracts saved browser passwords, session cookies, autofill data, crypto wallets, and authentication tokens, and dedicated channels aggregate and distribute the resulting logs. Session cookies are the most dangerous item because they can let an attacker skip passwords and even multi-factor prompts. The scale is large, and Europol said the infrastructure dismantled in Operation Endgame held several million stolen credentials, with many victims unaware their systems were infected. For a deeper look at how logs are produced and sold, see our guide to infostealer malware.

How dark web monitoring detects exposure after a RAT infection

Dark web monitoring cannot see the RAT on your device. Still, it can reveal the damage that follows: your credentials, session data, or corporate Access appearing in forums, Telegram channels, and stealer-log markets. That is often the first external evidence of an infection, since a quiet RAT may never trigger a local alert. A monitoring service watches for your domains, email addresses, and credential pairs in newly surfaced logs and breach dumps, and alerts you so you can reset passwords, kill sessions, and investigate the affected endpoint. DeXpose’s breached credentials monitoring is built for this stage, and you can check your own exposure with the Free Darkweb Report or the Email Data Breach Scan. Treat any hit as a trigger to rotate credentials and review the device that leaked them, using the steps in the removal section above.

How to Prevent RAT Infections

The best way to prevent RAT infections is to block the delivery routes covered above: stop risky attachments and downloads, patch exposed systems quickly, limit what any one account or program can do, and make stolen logins and sessions less useful. No single control is enough, because RATs arrive through email, exploits, cracked software, and social engineering. Layering these four areas covers most paths real campaigns use.

Email and download hygiene

Email and download hygiene means treating unexpected files, links, and instructions as hostile until you verify them. Filter or quarantine high-risk attachments such as scripts, disk images, shortcut files, and archives containing executables, and block Office macros from internet-sourced files. Show full file extensions so a file called “invoice.pdf.exe” is obvious. Install software only from the vendor’s own site or an official store, never from a cracked copy or a pop-up update, since Cloud9 spread through fake Adobe Flash Player update pages. Staff should also learn the newest trick: no legitimate site needs you to paste a command into a terminal or Run box to “fix” a camera, CAPTCHA, or error, which is exactly how the fake job interviews delivered PylangGhost and GolangGhost.

Patching and least privilege

Patching and least privilege reduce both the chance of infection and the damage if one happens. Prioritize internet-facing systems and anything with a public exploit, because attackers move fast. After a proof-of-concept exploit for the WSUS flaw CVE-2025-59287 was released, attackers quickly weaponized it to distribute ShadowPad. Retire unsupported devices too. HiatusRAT mainly targeted end-of-life DrayTek routers that no longer received patches, and more than 87.5% of Rafel RAT victims ran Android 11 or older. On the privilege side, remove local administrator rights from everyday accounts, use separate admin accounts for admin work, and never browse email from a privileged session. A RAT running as a standard user can do far less than one running as SYSTEM.

Application allow-listing and network egress controls

Allow-listing and egress filtering stop a RAT that has landed from running or from calling home. Application control tools such as Windows Defender Application Control or AppLocker permit only approved programs, blocking most unknown executables and scripts, especially if execution from user-writable folders like Downloads, AppData, and Temp is restricted. Egress controls work on the other side. Servers rarely need to reach the whole internet, so default-deny outbound rules, DNS filtering, and a web proxy make C2 connections harder. Since one XWorm chain used a Telegram-based command-and-control server, blocking Telegram and Discord APIs on servers and flagging them on workstations that have no business using them is a cheap, effective rule. Disabling or controlling USB storage also cuts off families like PlugX, whose variant spread through USB ports and attached drives.

MFA and session protection against token theft

MFA and session protection limit what an attacker can do with the credentials and cookies that a RAT or infostealer takes. Enforce multi-factor authentication everywhere, starting with remote Access, because VPN access is one of the most commonly sold access types and is often sold with working credentials and no MFA. Prefer phishing-resistant methods such as passkeys or FIDO2 security keys over SMS codes. Then protect the session itself, since cookie theft can let attackers take over a valid user session. Use short session lifetimes, conditional Access that checks device health and location, device-bound sessions where your platform supports them, and the ability to revoke all sessions quickly. Pair these controls with monitoring for stolen credentials appearing underground, so you can invalidate them before they are used.

Remote Access Trojan FAQs

Is a RAT a virus?

No, a RAT is a type of Trojan, not a virus. A virus attaches itself to files and replicates, while a RAT usually does not copy itself and relies on a person, a phishing email, or a loader to install it. People often say “RAT virus” casually, and antivirus tools treat it as malware either way. What matters is that a RAT gives an attacker remote control of the device.

Can someone control my computer without me knowing?

Yes, if a RAT is installed, someone can control your computer without any visible sign. RATs are designed to run quietly, hide their processes, and connect out to the operator on their own schedule. Warning signs include a cursor moving on its own, a webcam light turning on, unknown remote sessions, and security software being switched off. The attacker needs the malware to run first, so they can’t control a device that has never executed it this way.

Can an antivirus detect a RAT?

Often, but not always. Antivirus catches many known RAT families by signature, but new, packed, or Custom builds can slip past, especially when attackers rebuild a sample for each campaign. Endpoint detection and response (EDR) tools are stronger because they watch behavior such as unusual persistence, process injection, and beaconing. A clean antivirus scan reduces risk but doesn’t prove a device is safe, so combine it with updates, network monitoring, and an offline scan if you suspect an infection.

What is the difference between a RAT and a remote desktop tool?

A remote desktop tool is installed with the owner’s knowledge and consent, while a RAT is installed secretly and hides itself. Tools like Remote Desktop, AnyDesk, and TeamViewer show a session indicator and require authentication. A RAT offers similar control but conceals its files, processes, and traffic. The line can blur because attackers sometimes abuse legitimate remote tools, and some RATs are marketed as “administration software”, so consent and concealment are the deciding factors.

Is Quasar RAT safe?

Quasar is open-source remote administration software and is not malware by design, but it is not safe to run from an untrusted source, and it is widely abused. Criminals and espionage groups, including APT33, have used it. It is safe only when you build it yourself from the official source, use it on systems you own or are authorized to manage, and secure its server. Downloads from forums or “cracked” packages are risky: a trojanized XWorm builder spread through GitHub, file-sharing sites, Telegram and forums shows how booby-trapped RAT tools circulate.

What port does DarkComet listen on?

DarkComet’s default port is TCP 1604, though the operator can change it to anything. That default is a useful lead when reviewing old network logs or hunting for legacy infections, but a closed or different port doesn’t rule out DarkComet. Pair the port check with other indicators, such as the DC_MUTEX mutex naming, persistence entries, and beacon behavior.

Can an iPhone have RAT malware?

A standard, up-to-date iPhone is unlikely to have a commodity RAT because iOS isolates apps and installs software only through Apple-controlled routes. Realistic exceptions include jailbroken devices, malicious configuration profiles, and rare mercenary spyware. Apple describes mercenary spyware as among the most advanced digital threats in existence, and says it has notified users in over 150 countries since 2021. Keep iOS updated, avoid jailbreaking and remove unknown profiles, and consider Lockdown Mode if you are at high risk.

What is the most dangerous RAT?

No single RAT is the most dangerous, because risk depends on who is targeted and what the operator does next. By scale, PlugX stands out: French prosecutors said it had infected several million computers worldwide. By cost and flexibility in criminal use, modular commodity RATs such as XWorm are a major concern because they carry more than 35 plugins, including a ransomware module. Stealthily, privately shared tools like ShadowPad are the hardest to catch. The practical answer is to defend against the behavior, not the brand name.