What is a remote access trojan?
A remote access trojan, or RAT, is a trojan whose payload gives an attacker interactive control of the infected system. Like any trojan, it arrives in disguise: the user runs it on purpose because it looks like something wanted. Once installed, it connects out to the attacker's infrastructure and waits for instructions. The attacker can then browse and steal files, record keystrokes, take screenshots, turn on the webcam or microphone, run commands and use the machine as a foothold into the rest of the network.
How a RAT gets in and stays
Common delivery methods include cracked or free software, fake browser or driver updates, game mods, malicious email attachments and installers promoted through search ads. Some RATs come bundled with a working copy of the program the user wanted, so nothing seems wrong.
After installation, the RAT sets up persistence, such as a startup entry, a scheduled task or a service, so it survives a reboot. It then calls out to a command and control server. Because the infected host starts the connection, it passes through firewalls that block inbound traffic, and it often uses HTTPS so the traffic resembles normal browsing.
Signs of a RAT infection
- Regular outbound connections from the host to an unfamiliar address, often at a steady interval (beaconing), even when the machine is idle
- A new, unsigned program running from a user-writable folder such as AppData
- New startup items, scheduled tasks or services nobody recognizes
- The webcam light turning on unexpectedly, or the mouse and windows moving on their own
- Security tools disabled, or new local administrator accounts
Response and prevention
Because a RAT gives the attacker live access, disconnect the host from the network first, and preserve evidence if an investigation is likely. Block the command and control addresses at the firewall and proxy, search other hosts for the same file hash and connections, and reimage the affected machine instead of trusting a cleanup. Change passwords from a known-clean device, starting with privileged and email accounts.
Prevention relies on installing software only from trusted sources, application allow lists, standard user accounts, EDR that watches for unusual outbound connections, and egress filtering so unknown programs cannot freely reach the internet.
RAT vs. backdoor vs. remote administration tool
A backdoor is any hidden way back into a system that bypasses normal authentication; a RAT is one common way to plant one. Legitimate remote administration and remote support tools offer similar features, but they are installed with consent, visible to the user and managed by IT. When attackers abuse a legitimate remote support tool, the software itself is not malicious, so the scenario describes misuse of a legitimate tool, much like living off the land, rather than a RAT. A bot in a botnet is also remotely controlled, but it usually runs automated tasks across many machines rather than giving one operator an interactive session.
Remote access trojan on the CompTIA Security+ exam
RATs fall under SY0-801 objective 2.5, which covers malware types and their indicators. Scenario wording that points to a RAT describes a user who installed something that looked legitimate, followed by an outsider controlling the machine, running commands or watching through the webcam, and the host beaconing to an unknown server. Distractors include worm (it self-replicates), virus (it needs a host file), rootkit (its job is hiding) and keylogger (it only records keystrokes, though a RAT often includes one).