A commodity RAT, or commodity remote-access trojan, is a widely reused malware family that gives an attacker remote control over an infected system. Unlike custom implants built for one operation, commodity RATs are sold, leaked, and repurposed across many campaigns because they already include core functions such as command execution, file transfer, persistence, screenshots, and basic reconnaissance.
These tools matter in cyber security because they lower the cost of intrusion and make attacks easier to scale. Defenders often see them in phishing-based infections, loader chains, and post-exploitation activity where the initial payload is less important than the access it provides. Common examples include families like Remcos, AsyncRAT, and XWorm. Defense focuses on blocking delivery, detecting suspicious process and network behavior, monitoring persistence changes, and hunting for control-channel traffic. Even when the binary is familiar, it remains dangerous because a successful RAT can give an attacker long-lived access for theft, lateral movement, and further malware deployment.