What is What is a Remote Access Trojan (RAT)??

What is a Remote Access Trojan (RAT)?

malware OpenTrojan Team Updated 2026-08-20

A RAT gives attackers remote control of your device. Learn its behavior, targets, associated techniques, and how to defend.

Quick Answer

A Remote Access Trojan (RAT) gives an attacker remote control of an infected device, enabling data theft, surveillance, and further compromise.

Definition

A Remote Access Trojan (RAT) is malware that provides an attacker with remote control over an infected computer, often silently.

Overview

A Remote Access Trojan (RAT) is malware that gives an attacker remote control of an infected device. Unlike a simple backdoor, RATs often include full surveillance and administrative capabilities.

Behavior

Establishes command-and-control backdoors.
Logs keystrokes to steal credentials.
Captures screens, audio, and camera frames.
Exfiltrates files and installs further payloads.

Targets

RATs target individuals, small businesses, and enterprises — often for espionage, credential theft, and financial fraud.

Defense

Keep software patched to close initial-access vectors (e.g., SMB flaws like CVE-2017-0144).
Use endpoint detection and response (EDR) to spot remote-control behavior.
Restrict administrative privileges and disable unused remote-management tools.
Monitor for unexpected outbound connections to command-and-control infrastructure.

Malware Intelligence

Family: Remote Access Trojans

Aliases: RAT, Remote Administration Tool (abused)

Techniques: T1071 Application Layer Protocol, T1059 Command and Scripting Interpreter, T1005 Data from Local System

Targets: Individuals, SMBs and enterprises (espionage), Financial and credential-bearing accounts

Behavior:

Opens a backdoor for remote control
Keylogging and credential theft
Screen capture and webcam access
File exfiltration and download of additional payloads

References

https://www.cisa.gov/topics/cyber-threats-and-advisories

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating What is a Remote Access Trojan (RAT)?. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about What is a Remote Access Trojan (RAT)??

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.