What is a remote-access trojan (RAT)?

A remote-access trojan is malware that gives an attacker full control of a computer: they can see the screen, log keystrokes, open files, switch on the camera, run commands and use the machine as a stepping stone into the network. It usually arrives through phishing attachments, fake software downloads or cracked programs, and it keeps a connection to its operator, either open all the time or by checking in at intervals. On the computer, endpoint protection and application control are the main defences. On the network, the connection to the operator is the most reliable sign: small, regular traffic to an unfamiliar destination, often over HTTPS or an unusual port, sometimes relayed through a legitimate cloud service. NetSenX flags this beaconing on every plan, and from the Starter plan compares TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor.

← All 69 questions on Attack techniques explainedAll topics