RATtype

RATtype is a term used in cybersecurity to denote a family of remote access trojans (RATs) that share a common modular architecture and codebase. These families are designed to provide an attacker with persistent, covert access to compromised systems, enabling remote command execution, data collection, and system control.

Characteristics include modular plugins for different capabilities, decoupled components for persistence and communication, and multi-stage operation. Variants have been observed primarily targeting Windows environments, with some observations of macOS and Linux supports in later samples. Typical capabilities include remote desktop-like control, keylogging, screen capture, file management, process manipulation, credential theft, and exfiltration of documents or browser data. RATtype samples often implement anti-analysis techniques and use encrypted or obfuscated communication channels to hide C2 activity.

Delivery methods commonly involve phishing emails with malicious attachments, drive-by exploit kits, social engineering, or supply-chain compromises. Once installed, RATtype components may persist via startup entries, scheduled tasks, services, or rootkits, and establish covert C2 channels to maintain control even after user logoff.

Detection and mitigation involve endpoint security tools, network monitoring for unusual host-to-C2 traffic, and behavior-based detections. MITRE ATT&CK mappings typically include initial access, execution, persistence, privilege escalation, discovery, collection, command and control, and exfiltration techniques. Incident response emphasizes credential hygiene, patching, restricting macro-based documents, and segmenting critical networks.