What are remote access trojans (RATs)?

Remote access trojans (RATs) are a form of malware that provides unauthorized remote access and control of an infected computer or server. Once a hacker gains access, they can carry out various illegal activities without the owner's consent or knowledge. These activities include harvesting credentials, installing or removing software, stealing files, and hijacking webcams.

Understanding remote access trojans

A RAT operates through two components: a client installed on the victim's device, and a server controlled by the attacker. Once the client is running, it establishes an outbound connection to the attacker's server, periodically checking for instructions. A 2023 ScienceDirect paper on RAT traffic detection describes how modern RATs have shifted toward reverse-connected architectures specifically to bypass firewalls, since outbound connections from internal devices to external servers are far less likely to be blocked than inbound connection attempts. The attacker issues instructions through the server, the client executes them, and the results are returned, all while the compromised device appears to function normally.

Research from the Civilsphere Project on the growth and commoditization of RATs traces the evolution of these tools from early novelty malware developed to showcase technical skills into standardized, commercially available products. The research documents a dramatic increase in RAT families over the past decade and argues that RATs have become commodity tools available to attackers at any skill level. The transition from custom-developed to off-the-shelf RATs matters operationally: it means that sophisticated, persistent access capabilities are now accessible to threat actors who lack the expertise to build their own.

Read more: What is malware? | What is phishing? | What is social engineering?

The impact of RATs

Once a RAT is installed, the attacker has a persistent presence inside the network that survives reboots, password changes, and basic security scans. The access is not limited to a single session; it remains available for as long as the infection persists and the command-and-control (C2) infrastructure stays live.

A RAT can capture keystrokes, take screenshots at regular intervals, activate webcams or microphones, browse and exfiltrate files, harvest saved credentials from browsers, and download additional payloads, including ransomware. In healthcare, the specific danger is that a single compromised workstation may provide access to electronic health records (EHRs), billing and insurance systems, prescription platforms, and the email accounts through which protected health information (PHI) flows daily.

According to Paubox's 2025 Healthcare Email Security Report, ransomware attacks on healthcare organizations have surged 264% since 2018, according to HHS OCR data. RATs occupy the middle of that attack chain: they are how attackers establish the access and reconnaissance that precedes ransomware deployment. According to Paubox's 2026 Healthcare Email Security Report, 170 email-related healthcare breaches occurred in 2025, affecting more than 2.5 million individuals. Email remains the dominant initial delivery vector for RATs, meaning the infection begins with a message that reaches a user's inbox.

How RATs work

RATs reach victim devices through phishing emails carrying malicious attachments or links, malvertising that delivers drive-by downloads, trojanized software packages, and increasingly through multi-stage infection chains that use legitimate platforms like Dropbox, GitHub, or Cloudflare tunnels as intermediate stages. Check Point's February 2025 global threat index documented an AsyncRAT campaign that began with phishing emails containing Dropbox URLs, then proceeded through LNK files, JavaScript, and batch scripts before deploying the final payload. Using legitimate platforms at intermediate stages allows the malware to pass through email gateways and web filters that check URLs against reputation databases.

Once the client executable runs on the victim's device, it typically modifies registry keys or creates scheduled tasks to maintain persistence across reboots. It then connects outbound to the C2 server, often using encrypted channels that blend with normal HTTPS traffic. The encrypted nature of modern RAT communications is a documented detection challenge: a 2025 peer-reviewed study on encrypted RAT detection found that traditional signature-based detection systems struggle with encrypted traffic and proposes analyzing behavioral indicators and metadata, such as packet timing anomalies and persistent unidirectional connection flows, rather than attempting to inspect encrypted payload content.

The attacker then uses the established access at their discretion. Reconnaissance typically precedes any visible activity. Attackers map the network, identify high-value systems, and locate credential stores before taking actions that could trigger alerts. In healthcare environments, Paubox's Top 3 Healthcare Email Attacks in 2025 report describes how attackers with valid access search historical email for PHI and attachments, target billing and referral keywords, and create inbox rules to conceal their activity, the same behavioral pattern that follows a RAT-facilitated credential harvest.

Types of remote access trojans

RATs are frequently categorized by their origin, distribution model, and primary capabilities.

Open-source RATs are freely available on code repositories and underground forums. AsyncRAT and QuasarRAT are the most widely deployed examples. Recorded Future's 2025 year-in-review analysis of malicious infrastructure identified AsyncRAT and QuasarRAT as the leading RAT families throughout 2025, with widespread use across both financially motivated and state-aligned threat actors. The open-source nature of these tools means they can be modified, repackaged, and obfuscated without licensing costs, and their prevalence means defenders have learned to detect common variants, prompting attackers to distribute modified or crypter-wrapped versions that avoid known signatures.

Commercial RATs are sold on criminal forums, often with subscription pricing and customer support. Agent Tesla is one of the most widely tracked commercial RATs, capable of keylogging, screenshot capture, credential harvesting from browsers, and clipboard data theft. The CIS Multi-State Information Sharing and Analysis Center's Q2 2025 top malware report listed Agent Tesla as a consistently prevalent threat, noting it is purchased on criminal forums with varying capabilities depending on the tier purchased.

RAT-as-a-Service platforms package a RAT with delivery infrastructure, builder tools, and support into a subscription product. VenomRAT, which appeared in the CIS MS-ISAC top malware list for the first time in Q1 2025 and reached fourth position in Q2, is an open-source RAT with multiple community-developed versions capable of keylogging, screen capture, password theft, and data exfiltration. The broad availability of open-source and cracked versions means the distinction between commercial and free tooling has blurred considerably.

State-sponsored RATs are developed or deployed by nation-state actors for intelligence gathering and long-term access. These families tend toward greater sophistication in evasion and persistence, though Recorded Future's infrastructure analysis noted that state-aligned groups frequently use the same commodity RATs as financially motivated actors, specifically to avoid attribution.

Why RATs are harder to detect and stop

Several properties of modern RATs make them resistant to conventional detection. Outbound C2 communications are encrypted, often tunneled through legitimate cloud services, and timed to blend with normal traffic patterns. Persistence mechanisms modify system components that are rarely audited. Payload delivery is frequently staged across multiple legitimate platforms, none of which is inherently malicious. And the behavioral footprint of an attacker operating through a RAT often resembles legitimate administrative activity.

A 2025 MDPI study on RAT detection using hybrid machine learning approaches found that signature-based and traditional feature-based detection methods perform poorly against modern RAT traffic because the defining characteristics emerge from behavioral patterns over time rather than from static file signatures. The study found engineered behavioral features, including network timing patterns and traffic flow characteristics, substantially improved detection accuracy compared to standard methods.

Attackers are also aware of common detection approaches and actively work to avoid them. Crypter-as-a-service products wrap RAT payloads in obfuscated loaders that change the binary signature with each build. Steganography techniques embed payloads within image files. Process injection causes the RAT to execute within the memory space of legitimate Windows processes, making the malicious activity appear to originate from a trusted application.

Recognizing a RAT infection

RAT infections rarely announce themselves. Organizations are more likely to detect indicators than to catch the initial installation. Unusual outbound network connections to unfamiliar IP addresses or domains, particularly connections that occur at regular intervals or during off-hours, are a strong signal. Unexpected modification of registry keys or creation of scheduled tasks by a process that has no obvious reason to do so warrants investigation.

In healthcare environments specifically, post-access behavior provides additional indicators. A workstation that suddenly accesses file directories it does not normally reach, or generates email queries for billing terms, patient identifiers, or financial keywords outside its normal usage pattern, may indicate RAT-facilitated reconnaissance. According to Paubox's 2025 Mid-Year Email Breach Data report, 41% of assessed healthcare organizations were classified as high risk in the first half of 2025, up from 31% the prior year, a figure that reflects persistent gaps in the configuration discipline that would catch anomalous behavior early.

Best practices for defending against RATs

Pre-delivery email filtering is the most used defensive control available, because email remains the dominant initial delivery vector for RATs. Stopping malicious attachments and links before they reach inboxes removes the primary mechanism through which RATs are installed. According to Paubox's 2025 Healthcare Email Security Report, only 5% of known phishing attacks are reported by employees, meaning the remaining 95% that go unreported rely entirely on technical controls to prevent delivery and execution. Paubox Inbound Email Security uses generative AI to analyze sender behavior, tone, and message intent, detecting malicious emails that bypass signature-based filters, including those carrying RAT delivery payloads staged through legitimate platforms.

Endpoint detection and response (EDR) solutions that monitor for behavioral anomalies rather than matching known signatures provide the next layer. Because behavioral analysis approaches RAT detection through the patterns described in the MDPI research network, timing, process injection artifacts, and unusual persistence mechanisms, they catch variants that evade signature databases. Network monitoring for anomalous outbound connection patterns, particularly regular interval connections to unfamiliar external hosts, provides a complementary detection surface.

Application allowlisting, which restricts which executables can run on a device, prevents the installation of any RAT not specifically permitted, regardless of how it was delivered. Segmenting clinical networks from administrative ones limits how far a RAT installed on one workstation can propagate or reach sensitive systems.

Learn more: Paubox Inbound Email Security | Paubox Email Suite | Paubox's 2026 Healthcare Email Security Report

In the news

In December 2023, Zscaler’s ThreatLabz discovered fake Skype, Google Meet, and Zoom websites spreading malware. These sites tricked users into downloading harmful software, with Android users getting the SpyNote remote access Trojan (RAT) and Windows users receiving NjRAT and DCRat. The fake sites, hosted on a single Russian IP address, closely mimicked real platforms, making them convincing. When users clicked to download the apps, they unknowingly installed malicious files. Zscaler's analysis helped identify these threats, indicating the need for strong security measures. As cyber threats become more complex, businesses must stay alert and protect themselves.

FAQs

What are RATs, and how do they relate to healthcare security?

Remote access trojans (RATs) are malicious software programs that enable unauthorized individuals to gain remote access and control over infected devices or systems. In healthcare, RATs can compromise sensitive patient information, medical devices, and network infrastructure.

Why are RATs a concern for HIPAA compliance in healthcare settings?

RATs are a concern because they can lead to unauthorized access to protected health information (PHI), compromise patient confidentiality, and violate HIPAA’s security and privacy requirements. Successful RAT attacks can result in data breaches, financial penalties, and legal consequences for healthcare organizations.

What are the potential risks associated with RATs under HIPAA?

Potential risks of RATs include:

• Data exfiltration: Unauthorized extraction and theft of patient data and medical records.
• Device manipulation: Remote control of medical devices to alter settings or interfere with patient care.
• Network compromise: Infiltration of healthcare networks to launch additional attacks or spread malware.
• Service disruption: Interruption of healthcare services due to compromised systems or devices.

See also: HIPAA Compliant Email: The Definitive Guide