Attackers use MarkiRAT as a remote access trojan to control compromised systems and carry out post-compromise activity such as reconnaissance and file theft. It is valuable when an intruder wants dependable access without immediate noise. Defenders should monitor for persistent outbound connections, unusual artefacts and scripting or loader activity.
How MarkiRAT supports an attacker’s post-compromise workflow
MarkiRAT is most useful after initial access, when the attacker wants reliable control of a host and a foothold that can be used repeatedly without immediately breaking the compromise. In practice, that means it behaves like a remote access trojan rather than a one-off payload: it helps the operator stay present, issue commands, and work through the environment at a controlled pace.
That distinction matters because the operator’s goal is usually not just execution, but sustained access. A RAT gives an intruder a stable channel to inspect the system, test privileges, identify useful files, and decide whether to move laterally or harvest data. When defenders see this pattern, they should think in terms of post-exploitation activity, not only malware delivery.
When malware is being used to maintain access and support follow-on actions, the relevant defensive lens is broad detection and containment. The Malware Guide is a useful starting point for recognising RAT behaviour, loaders, evasion patterns, and the operational differences between malware families that merely land on a system and those that actively sustain operator control.
What attackers typically do once MarkiRAT is running
Once MarkiRAT is established, attackers commonly use it for reconnaissance, file discovery, and selective theft of documents or other useful artefacts. They may browse directories, check running processes, enumerate accounts or network details, and stage data for exfiltration. That is why a RAT is often paired with credential theft, scripting, or additional loaders: it is a workhorse for controlled hands-on activity after compromise.
The most dangerous phase is often not the initial malware execution but the quiet period afterward, when an operator uses the RAT to learn the environment and preserve access. Persistent outbound connections, unfamiliar child processes, scripted commands, and unusual archive or staging behaviour are often more informative than a single malicious file hash. A good investigation focuses on what the attacker was trying to accomplish, not just on the binary itself.
For broader attack-path context, the MITRE ATT&CK Enterprise Matrix helps map the sort of post-compromise actions a RAT enables, including persistence, discovery, credential access, lateral movement, and exfiltration. It is also useful to review the CISA cyber threat advisories for current attacker tradecraft that may appear alongside RAT-based intrusion campaigns.
What defenders should look for when a RAT is suspected
MarkiRAT-style activity is often detected through behaviour, not by the malware name alone. Watch for durable outbound sessions to unfamiliar hosts, command execution from non-interactive processes, repeated access to user data, and evidence of staging or compression before transfer. If the implant is embedded in a loader chain, the loader’s execution path and the parent-child process tree can be more revealing than the final payload.
Defenders should also treat any confirmed RAT presence as a compromise indicator, not a standalone malware event. That means checking for additional persistence, neighbouring accounts or endpoints with the same indicators, and signs that the attacker already used the foothold to retrieve data or enumerate the environment. If the RAT can survive reboots or re-establish contact, assume the operator may return unless the underlying access path is removed.
Risk and Threat Considerations
RATs are attractive because they convert one successful intrusion into repeatable operator access. The risk is not only execution, but the attacker’s ability to remain interactive, pivot, and selectively steal data while blending into ordinary administrative or scripting activity.
Failure mechanism: A persistence mechanism, loader chain, or long-lived outbound channel lets the implant reconnect after interruption, giving the attacker a dependable control plane for discovery and theft.
Impact: The compromise can expand from a single host to broader environment access, with higher likelihood of data loss, lateral movement, and prolonged dwell time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0008 — Lateral Movement | MarkiRAT supports post-compromise movement and discovery. |
| TA0005 — Defense Evasion | RATs often hide interactive control and loader activity. | |
| TA0011 — Command and Control | A RAT depends on durable outbound control links. | |
| Recommendation — Map observed activity to ATT&CK tactics and hunt for discovery, persistence, and exfiltration. Correlate loader and script execution with evasion indicators in telemetry. Monitor for persistent outbound sessions and unfamiliar C2 infrastructure. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | RAT detection and containment depend on anti-malware and behavioural controls. |
| CIS-13 — Network Monitoring and Defense | Outbound control traffic and exfiltration are key RAT signals. | |
| Recommendation — Tune malware defenses to alert on RAT loaders, persistence, and staging activity. Inspect egress patterns for long-lived or unusual remote control connections. | ||
Practitioner Guidance
What to verify: Confirm whether the suspected host has any surviving persistence, scheduled tasks, services, autoruns, or unusual network egress that would allow the operator to regain access after cleanup. If those remain, eradication is incomplete even if the malware file is removed.
Decision rule: If the RAT has touched sensitive systems, data stores, or privileged accounts, treat the case as a containment and exposure assessment first, and a malware-removal task second. The key question is whether the attacker merely ran code, or whether they used the foothold to collect data or expand access.
Practitioner takeaway: For RAT activity, the important judgement is whether the implant represents a temporary intrusion artefact or a durable attacker control path, because that distinction determines how aggressively you must hunt, isolate, and recover.