Remote Access Trojan
Remote Access Trojan (RAT) is a malware category that enables attackers to gain remote control of an infected system. In the provided reporting, RATs are described as being used in multiple intrusion and fraud scenarios. Italian authorities warned that the operating system of the Italian passenger ferry Fantastic may have been infected by a RAT while docked in Sète, France; investigators assessed that such malware could have provided remote access to onboard systems, possibly including navigation-related components, and the case is being examined as suspected foreign interference with possible state involvement. The content also states that remote access software on poorly isolated systems can enable lateral movement into sensitive networks.
RATs are also referenced in social-engineering campaigns. ReliaQuest reported that the Scattered Lapsus$ Hunters group targeted organizations using Zendesk by submitting fraudulent support tickets and using typosquatted or impersonating Zendesk-related domains, fake SSO portals, and crafted pretexts to infect support and help-desk personnel with RATs and other malware, with the goal of stealing credentials, compromising endpoints, stealing data, and extorting victims. Separate reporting cited Google warnings that scammers embed RATs and info-stealers in fake interview software, application materials, malicious job application downloads, and broader online job scam workflows. These campaigns use fake recruiter profiles, cloned career pages, and fraudulent application forms; resulting infections can provide persistent backdoor access, facilitate credential harvesting, financial theft, identity fraud, system compromise, and corporate network infiltration when infected personal devices later connect to enterprise environments. Additional content notes that malicious VPN apps and browser extensions distributed via social engineering can also deliver RATs alongside information stealers and banking malware.
No single RAT family, specific malware sample, or unique IOC set is identified in the provided content; the term is used generically to describe malware that provides unauthorized remote access and persistence across maritime, enterprise help-desk, and job-scam infection scenarios.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Resource Development
1 technique
Resource Development
Initial Access
3 techniques
Initial Access
When the axios HTTP client library was compromised, attackers pushed two poisoned releases that dropped a remote-access Trojan on every machine that ran a fresh install during a roughly three-hour window.
Execution
4 techniques
Execution
A separate supply-chain attack on the widely used Axios npm package occurred within hours of the leak, injecting a remote-access trojan into versions 1.14.1 and 0.30.4.
VentureBeat reported that anyone who installed or updated Claude Code via npm on March 31 between 00:21 and 03:29 UTC may have pulled in the compromised dependency.
Stealth
3 techniques
Stealth
The package impersonated an installer for OpenClaw... The campaign combined brand impersonation with malicious package delivery, using a familiar project name to increase the odds of installation by developers or users seeking OpenClaw tooling.
Credential Access
1 technique
Credential Access
Collection
1 technique
Collection
Command and Control
3 techniques
Command and Control
Check your network logs for connections to sfrclak[.]com or 142.11.206.73 on port 8000
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Remote Access Trojan (RAT) is a type of malware that allows attackers to remotely control infected systems, potentially providing access to sensitive ship functions including navigation and operating systems.
Remote Access Trojans (RATs) are used to provide attackers with persistent, covert access to compromised endpoints, allowing them to steal data, move laterally, and further compromise the organization.
Remote Access Trojans (RATs) are a type of malware that provide persistent remote access to compromised systems, allowing attackers to control the victim's machine, exfiltrate data, and deploy additional payloads.
Remote Access Trojans (RATs) are being delivered through fake job application forms and interview software, providing persistent backdoor access to compromised devices. Once installed, they allow attackers to control the victim's device, harvest credentials, and potentially infiltrate corporate networks when the infected device connects to enterprise resources.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.