A remote access trojan gives an operator a hands-on keyboard inside the network, so every RAT infection should be handled as an active intrusion with a human on the other end, not as a malware clean-up. This hub covers the 67 software entries that NHI Mgmt Group groups as remote access trojans in MITRE ATT&CK Enterprise v20, all classed by ATT&CK as malware. It ranges from commodity RATs sold or leaked to anyone, such as njRAT, NanoCore and WarzoneRAT, to state-used families such as PlugX, BLINDINGCAN and ROKRAT. It lists every entry with its platforms, the groups ATT&CK links to it and its most distinctive techniques, summarises the shared behaviours computed from the v20 technique relationships, and turns them into detection, hardening and response priorities. It is for detection engineers, threat hunters and incident responders.
Key takeaways
- Surveillance is the common job. Keylogging (T1056.001) maps to 27 of the 67 entries and Screen Capture (T1113) to 26; nine can record video (T1125) and eight audio (T1123).
- A few RATs are everywhere. ATT&CK v20 links PlugX to 15 groups, PoisonIvy to 14, gh0st RAT to 11 and njRAT to 8, because their code is public, leaked or widely shared.
- Service persistence and custom protocols stand out. Sixteen entries persist as a Windows service (T1543.003) and 13 use a non-application layer protocol (T1095), both less common in loaders and banking trojans.
- Commodity RATs are a service market. The US Attorney's Office for the Northern District of Georgia reported in February 2024 that WarzoneRAT was sold with online customer support before its domains were seized.
- Removal can be a law enforcement action. The US Department of Justice announced in January 2025 that it had deleted a PlugX version from about 4,258 US computers, which shows how long a RAT can stay on unmanaged machines.
What counts as a remote access trojan
ATT&CK classifies each software entry only as malware or a tool. Many entries in this hub are described by ATT&CK as "remote access tool (RAT)", which is why the category sits close to T1219 Remote Access Tools, the technique for abusing legitimate remote administration software. The difference matters for response: a legitimate tool is installed, signed and often allowed, while a RAT is malware built or adapted to hide. This hub groups the malware entries whose description centres on remote control of the victim host, plus Snip3, which ATT&CK describes as a crypter-as-a-service used since at least 2021 to load AsyncRAT, Revenge RAT, Agent Tesla and NETWIRE.
The family falls into three practical groups:
- Commodity and builder RATs: njRAT, NanoCore, NETWIRE, Revenge RAT, WarzoneRAT, Cobian RAT and gh0st RAT. ATT&CK describes NETWIRE as publicly available and multiplatform and used by criminal and APT groups since at least 2012. See the AsyncRAT, Remcos and njRAT Commodity RATs Guide.
- Shared espionage RATs: PlugX, PoisonIvy, Winnti for Windows, Sakula and Zox, passed between groups. See the PlugX and ShadowPad Malware Guide.
- Group-specific RATs: for example the North Korean families FALLCHILL, BLINDINGCAN, HotCroissant and MagicRAT linked to Lazarus Group, ROKRAT and BLUELIGHT linked to APT37, and Crimson and ObliqueRAT linked to Transparent Tribe.
Membership follows the NHI Mgmt Group software category list. Counts are computed from the ATT&CK Enterprise v20 STIX data with revoked and deprecated objects removed. For the general discipline, see the Remote Access Trojans (RATs) Guide; this hub is the ATT&CK catalogue view.
Shared behaviours across the family
The 67 entries map to 176 distinct techniques and sub-techniques. By tactic, 61 entries have a Stealth (TA0005) technique, 60 Discovery, 58 Command and Control, 57 Execution and 47 Collection, and 30 have a Credential Access technique, far more than loaders. All 67 list Windows as a platform; four also list macOS and three Linux.
| Technique | Entries (of 67) | What to look for |
|---|---|---|
| T1059.003 Windows Command Shell | 46 | A remote shell: cmd.exe as a child of an unusual process, often with redirected input and output |
| T1105 Ingress Tool Transfer | 46 | Operator uploads tools to the host after first contact |
| T1082 System Information Discovery | 44 | Host profiling at check-in |
| T1083 File and Directory Discovery | 40 | Browsing the file system remotely |
| T1071.001 Web Protocols | 38 | HTTP or HTTPS beaconing from a non-browser process |
| T1070.004 File Deletion | 37 | Removal of dropped files and collected data after exfiltration |
| T1547.001 Registry Run Keys / Startup Folder | 31 | Persistence through Run keys or the Startup folder |
| T1573.001 Symmetric Cryptography | 28 | Custom encrypted command and control, often over raw TCP |
| T1056.001 Keylogging | 27 | Keyboard hooks installed by a process that is not an input method |
| T1113 Screen Capture | 26 | Repeated screen grabs by a background process |
| T1543.003 Windows Service | 16 | New services pointing at binaries in user writable or unusual paths |
| T1095 Non-Application Layer Protocol | 13 | Command and control over raw TCP, UDP or ICMP rather than HTTP |
| T1555.003 Credentials from Web Browsers | 9 | Browser credential stores read by a non-browser process |
| T1125 Video Capture | 9 | Webcam access by an unknown process |
| T1571 Non-Standard Port | 8 | Outbound connections on ports that do not match the protocol |
Who uses these RATs
| Group | Entries in this hub | Examples |
|---|---|---|
| Lazarus Group | 8 | FALLCHILL, Bankshot, TYPEFRAME, HotCroissant, Dacls, BLINDINGCAN, ECCENTRICBANDWAGON, MagicRAT |
| TA2541 | 5 | NETWIRE, Revenge RAT, njRAT, WarzoneRAT, Snip3 |
| Axiom | 4 | PoisonIvy, PlugX, gh0st RAT, Zox |
| Transparent Tribe | 4 | Crimson, Peppy, ObliqueRAT, njRAT |
| APT37 | 3 | ROKRAT, NavRAT, BLUELIGHT |
| APT41 | 3 | PlugX, gh0st RAT, njRAT |
| GALLIUM | 3 | PoisonIvy, PlugX, PingPull |
ATT&CK also links WarzoneRAT to Scattered Spider, and FlawedAmmyy to TA505 and FIN6, showing that commodity RATs are used by financially motivated intrusion groups as well as espionage actors.
Detection priorities
- Remote shell patterns: cmd.exe or PowerShell whose parent is an unsigned or newly seen binary, or a service, with no interactive user session behind it (T1059.003).
- Surveillance APIs from background processes: keyboard hooks, repeated screen capture and webcam or microphone access by processes that are not known conferencing, accessibility or input tools (T1056.001, T1113, T1125, T1123).
- New services and Run keys: services created with binaries in ProgramData, temp or user folders, and Run keys added by recently written executables (T1543.003, T1547.001).
- Beaconing: regular outbound connections from one process to one destination, especially over raw TCP or on ports that do not match the protocol (T1095, T1571), and HTTPS from processes that never used the network before (T1071.001).
- Side-loaded launchers: PlugX and several others use DLL side-loading (T1574.001); watch for signed executables loading unsigned DLLs outside their install path.
- Hands-on follow-up: discovery commands, tool uploads and lateral movement such as Remote Desktop (T1021.001, linked to four entries) after a RAT check-in mean a person is active and response must start now.
For building and testing analytics, see the ATT&CK Detection Strategies and Analytics Guide.
Hardening and response
| Control | What it stops or limits | Techniques |
|---|---|---|
| Application control that blocks unsigned executables and DLLs from user writable paths | Most commodity RAT payloads and side-loaded launchers | T1204.002, T1574.001 |
| Default-deny egress for servers and authenticated proxy egress for workstations | Raw TCP and non-standard port command and control | T1095, T1571, T1071.001 |
| Standard user rights and restricted service creation | Service persistence and many privilege escalation paths | T1543.003, T1547.001 |
| Camera and microphone privacy settings managed by policy | Silent video and audio capture by unapproved apps | T1125, T1123 |
| Inventory of approved remote administration tools, with everything else blocked | Confusion between legitimate tools and RATs during triage | T1219 |
| Isolate, then investigate: network containment of the host before cleaning | Operator reaction and further collection during response | All |
See the App Control for Business (WDAC) guide for executable and DLL control.
Real cases
- PlugX deletion operation, January 2025: the US Department of Justice announced on 14 January 2025 that it and the FBI had deleted a version of PlugX from about 4,258 US computers, working with French law enforcement and the French company Sekoia.io. DOJ attributes the malware version to a group sponsored by the People's Republic of China known in the private sector as Mustang Panda and Twill Typhoon. See the Mustang Panda Threat Actor Profile.
- WarzoneRAT takedown, February 2024: the US Attorney's Office for the Northern District of Georgia reported on 9 February 2024 that federal authorities seized warzone.ws and three related domains, that the RAT was sold through those domains with online customer support, and that it let buyers browse files, take screenshots, record keystrokes, steal usernames and passwords and watch victims through their webcams. Partners included Canada, Croatia, Finland, Germany, the Netherlands and Romania, coordinated largely through Europol.
- BLINDINGCAN: ATT&CK describes it as used by the North Korean government since at least early 2020 against defence, engineering and government organisations in Western Europe and the US.
Where identity fits
A RAT gives its operator the identity of whoever is logged on. Keyloggers and screen capture collect passwords and one-time codes as they are typed, nine entries read saved browser credentials, and an operator with a shell can read tokens, SSH keys, cloud CLI credentials and service account secrets stored on the host. Response therefore has two parts: contain the device, and treat every credential used on it as exposed. Rotate the user's passwords and revoke their sessions, then rotate any machine credentials, API keys and tokens present on the host, prioritising those with access to production or identity systems. See the Remote Access Identity Guide for controlling legitimate remote access.
Catalogue: all 67 entries
Every member in the category, sorted by name. Associated groups are up to three intrusion sets ATT&CK v20 links to the software (PlugX, PoisonIvy and gh0st RAT have many more); where none is linked but a campaign is, the campaign is shown. "Distinctive techniques" are up to three of the entry's techniques that are least common across the hub, useful as hunting leads.
| ID | Name | Type | Platforms | Associated groups (v20) | Distinctive techniques |
|---|---|---|---|---|---|
| S0066 | 3PARA RAT | malware | Windows | Putter Panda | T1070.006, T1573.001, T1071.001 |
| S0065 | 4H RAT | malware | Windows | Putter Panda | T1573.001, T1057, T1071.001 |
| S1028 | Action RAT | malware | Windows | SideCopy | T1047, T1518.001, T1027 |
| S0234 | Bandook | malware | Windows | Dark Caracal | T1027.003, T1059, T1553.002 |
| S0239 | Bankshot | malware | Windows | Lazarus Group | T1087.001, T1087.002, T1001.003 |
| S0127 | BBSRAT | malware | Windows | None linked in v20 | T1560.002, T1546.015, T1569.002 |
| S0268 | Bisonal | malware | Windows | Tonto Team | T1137.006, T1497, T1568 |
| S0520 | BLINDINGCAN | malware | Windows | Lazarus Group | T1129, T1553.002, T1070.006 |
| S0657 | BLUELIGHT | malware | Windows | APT37 | T1539, T1560.003, T1102.002 |
| S0348 | Cardinal RAT | malware | Windows | None linked in v20 | T1008, T1560.002, T1027.004 |
| S0338 | Cobian RAT | malware | Windows | None linked in v20 | T1071.004, T1123, T1125 |
| S0115 | Crimson | malware | Windows | Transparent Tribe | T1114.001, T1091, T1614 |
| S0235 | CrossRAT | malware | Linux, Windows, macOS | Dark Caracal | T1547.013, T1543.001, T1113 |
| S0497 | Dacls | malware | macOS, Linux, Windows | Lazarus Group | T1543.004, T1036, T1543.001 |
| S1014 | DanBot | malware | Windows | HEXANE | T1021.005, T1071.004, T1053.005 |
| S0673 | DarkWatchman | malware | Windows | None linked in v20 | T1490, T1568.002, T1027.010 |
| S0694 | DRATzarus | malware | Windows | Campaign: Operation Dream Job | T1622, T1018, T1497.003 |
| S0593 | ECCENTRICBANDWAGON | malware | Windows | Lazarus Group, APT38 | T1074.001, T1027, T1113 |
| S0569 | Explosive | malware | Windows | Volatile Cedar | T1025, T1564.001, T1115 |
| S0181 | FALLCHILL | malware | Windows | Lazarus Group | T1001.003, T1070.006, T1680 |
| S0381 | FlawedAmmyy | malware | Windows | FIN6, TA505 | T1001, T1056, T1069.001 |
| S0383 | FlawedGrace | malware | Windows | TA505 | T1027.013 |
| S0032 | gh0st RAT | malware | Windows, macOS | Axiom, PittyTiger, APT18 | T1059, T1568.001, T1685.005 |
| S0237 | GravityRAT | malware | Windows | None linked in v20 | T1027.005, T1559.002, T1007 |
| S0071 | hcdLoader | malware | Windows | APT18 | T1543.003, T1059.003 |
| S0087 | Hi-Zor | malware | Windows | None linked in v20 | T1218.010, T1573.002, T1027.013 |
| S0431 | HotCroissant | malware | Windows | Lazarus Group | T1489, T1007, T1518 |
| S0259 | InnaputRAT | malware | Windows | None linked in v20 | T1036.004, T1027, T1680 |
| S0437 | Kivars | malware | Windows | BlackTech | T1021, T1564.003, T1113 |
| S0356 | KONNI | malware | Windows | None linked in v20 | T1134.004, T1048.003, T1134.002 |
| S0681 | Lizar | malware | Windows | FIN7 | T1055.002, T1087.003, T1588.002 |
| S0582 | LookBack | malware | Windows | None linked in v20 | T1529, T1489, T1007 |
| S1182 | MagicRAT | malware | Windows | Lazarus Group | T1036.008, T1053.005, T1036.005 |
| S0652 | MarkiRAT | malware | Windows | Ferocious Kitten | T1555.005, T1614.001, T1197 |
| S0459 | MechaFlounder | malware | Windows | APT39 | T1059.006, T1132.001, T1036.005 |
| S0339 | Micropsia | malware | Windows | APT-C-23 | T1560.001, T1547.009, T1119 |
| S0280 | MirageFox | malware | Windows | Ke3chang | T1574.001, T1140, T1033 |
| S0149 | MoonWind | malware | Windows | None linked in v20 | T1120, T1571, T1074.001 |
| S0228 | NanHaiShu | malware | Windows | Leviathan | T1218.005, T1059.007, T1071.004 |
| S0336 | NanoCore | malware | Windows | Group5, APT33, Gorgon Group | T1686, T1685, T1123 |
| S0247 | NavRAT | malware | Windows | APT37 | T1071.003, T1055, T1074.001 |
| S0198 | NETWIRE | malware | Windows, Linux, macOS | APT33, SilverTerrier, The White Company | T1036.001, T1053.003, T1059.004 |
| S0385 | njRAT | malware | Windows | Group5, Gorgon Group, APT41 | T1070.009, T1568.001, T1686.003 |
| S0353 | NOKKI | malware | Windows | Kimsuky | T1056.004, T1071.002, T1218.011 |
| S0644 | ObliqueRAT | malware | Windows | Transparent Tribe | T1030, T1027.003, T1025 |
| S0346 | OceanSalt | malware | Windows | None linked in v20 | T1132.002, T1566.001, T1016 |
| S0643 | Peppy | malware | Windows | Transparent Tribe | T1020, T1113, T1056.001 |
| S1031 | PingPull | malware | Windows | GALLIUM | T1036.004, T1070.006, T1571 |
| S0013 | PlugX | malware | Windows | Axiom, DragonOK, APT3 | T1027.007, T1102.001, T1127.001 |
| S0428 | PoetRAT | malware | Windows | None linked in v20 | T1048, T1059.011, T1003.001 |
| S0012 | PoisonIvy | malware | Windows | Axiom, Moafee, APT1 | T1547.014, T1014, T1480.002 |
| S0379 | Revenge RAT | malware | Windows | The White Company, TA2541 | T1003, T1202, T1547.004 |
| S0433 | Rifdoor | malware | Windows | Andariel | T1027.001, T1566.001, T1204.002 |
| S0240 | ROKRAT | malware | Windows | APT37 | T1567.002, T1480.001, T1555.004 |
| S0253 | RunningRAT | malware | Windows | None linked in v20 | T1685.005, T1685, T1560 |
| S0074 | Sakula | malware | Windows | Deep Panda | T1548.002, T1574.001, T1218.011 |
| S1086 | Snip3 | malware | Windows | TA2541 | T1104, T1189, T1102 |
| S0646 | SpicyOmelette | malware | Windows | Cobalt Group | T1553.002, T1566.002, T1018 |
| S0011 | Taidoor | malware | Windows | None linked in v20 | T1055.001, T1124, T1012 |
| S0263 | TYPEFRAME | malware | Windows | Lazarus Group | T1686.003, T1027.011, T1090 |
| S0333 | UBoatRAT | malware | Windows | None linked in v20 | T1197, T1102.002, T1497.001 |
| S0257 | VERMIN | malware | Windows | None linked in v20 | T1119, T1560, T1027.002 |
| S0670 | WarzoneRAT | malware | Windows | Confucius, Scattered Spider, TA2541 | T1221, T1564, T1014 |
| S0141 | Winnti for Windows | malware | Windows | Winnti Group, Aquatic Panda | T1090.001, T1090.002, T1027.015 |
| S1065 | Woody RAT | malware | Windows | None linked in v20 | T1016.001, T1087, T1203 |
| S0672 | Zox | malware | Windows | Axiom | T1001.002, T1068, T1021.002 |
| S0350 | zwShell | malware | Windows | Campaign: Night Dragon | T1021.002, T1021.001, T1053.005 |
Framework mapping
| Framework | Reference | Relevance to RATs |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-3 Malicious Code Protection | Detecting and blocking RAT payloads |
| NIST SP 800-53 Rev 5 | SI-4 System Monitoring | Endpoint and network telemetry for shells, surveillance APIs and beaconing |
| NIST SP 800-53 Rev 5 | AC-6 Least Privilege | Limiting service creation and what an operator inherits |
| NIST CSF 2.0 | DE.CM-01 | Networks and network services are monitored for adverse events |
| NIST CSF 2.0 | PR.PS-05 | Installation and execution of unauthorised software are prevented |
| CIS Controls v8.1 | Control 10 and Control 13 | Malware defences; network monitoring and defence |
| ISO/IEC 27001:2022 | Annex A 8.7 and 8.16 | Protection against malware; monitoring activities |
Common failure patterns
- Cleaning before containing. The file is deleted while the operator still has a session, so they move to another host.
- Credentials left valid. Passwords, sessions and machine credentials captured by the RAT are not rotated after clean-up.
- Allowing all outbound ports from servers. Raw TCP command and control on unusual ports goes unnoticed.
- Treating njRAT or NanoCore as nuisance malware. ATT&CK links both to multiple groups; commodity does not mean low impact.
- No list of approved remote tools. Analysts cannot tell a RAT from a sanctioned remote support agent quickly.
Practitioner checklist
- Check your detections against the 15 shared techniques in the behaviour table.
- Alert on remote shells spawned by unsigned, new or service processes.
- Hunt for background processes using keyboard hooks, screen capture, camera or microphone.
- Restrict egress from servers to required destinations and ports.
- Keep an inventory of approved remote administration tools and block the rest.
- Isolate infected hosts before cleaning and preserve memory where possible.
- Rotate user and machine credentials present on any host where a RAT ran.
- Track RAT families linked to groups that target your sector.
Standards and references
- MITRE ATT&CK: Software
- MITRE ATT&CK: ATT&CK STIX Data (Enterprise v20)
- MITRE ATT&CK: PlugX (S0013)
- MITRE ATT&CK: Remote Access Tools (T1219)
- US Department of Justice: Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers
- US Attorney's Office, Northern District of Georgia: International cybercrime malware service dismantled by federal authorities
Related NHI Mgmt Group resources: ATT&CK Loaders and Droppers Software Hub, ATT&CK Banking Trojans Software Hub, Remote Access Trojans (RATs) Guide, MITRE ATT&CK Guide for Defenders.