Remote Access Trojans Targeting Government Networks

A remote access trojan gives an attacker interactive, hands-on control of a machine, the same control an IT admin has over your work laptop, minus the part where anyone invited them. Against government targets specifically, RATs matter more than almost any other malware category because the whole point of the tool is patience: get in, go quiet, come back when it's useful. This piece walks through why that mix of quiet entry, hands-on control, and long dwell time made RATs the default tool for sitting inside a government network for months or years, and what that means for the people trying to find them. Fair warning: there's no tidy ending here, just a lot of agencies playing defense against something built to look boring.

Quick distinction, because people mix this up constantly. Ransomware wants attention; it locks your files and demands money, and the business model only works if you see the ransom note. Infostealers are the opposite of patient: grab passwords, grab cookies, leave. RATs are a third animal entirely. Mandiant's 2024 incident response data found backdoor functionality, the trait that actually defines a RAT, in roughly 35% of the malware families they investigated that year. That backdoor is the whole point of the exercise. It lets someone leave and come back, change their approach, escalate when the timing's right, without breaking in twice. Most RAT families run the same basic toolkit under the hood: remote shell, keylogging, screen and webcam capture, file theft, staging for lateral movement, and command-and-control traffic dressed up to look dull. And "trojan" isn't just branding; these things get delivered as a PDF, a software update, some utility the victim opens on their own. The victim does the actual work of infecting themselves, which, if you sit with it too long, is a little insulting.

Why the RAT market has grown into a mature, scalable threat industry

Start with the number, because it tells the story by itself: 384 unique malware varieties sold on major criminal forums in 2024, up from 349 the year before, per Bitsight's 2025 State of the Underground report. RATs ranked second only to infostealers. That's not some fringe corner of cybercrime anymore. That's a product category with shelf space, return customers, and probably a loyalty program somewhere.

Malware-as-a-Service explains most of it. You don't need to write your own RAT anymore, or even know how one works, to run a campaign. Rent the payload, rent the C2 panel, rent the hosting, and you're open for business by dinner. Bitsight tracked continued growth in both MaaS and RAT activity through the first half of 2025, and Recorded Future's H1 2025 analysis flagged something worth sitting with: AsyncRAT, XWorm, and Remcos have all been gaining ground as attackers move away from single-purpose infostealers toward tools that do both jobs at once. Steal the data, keep the door propped open. Why buy two tools when one does both?

That convergence creates a problem defenders feel directly, and it's a structural one, not a bad-luck one. When new variants show up faster than anyone can catalog them, signature-based detection falls behind as a matter of math, not effort. State-sponsored operators have clearly noticed that the noise works in their favor, too: a custom nation-state RAT can hide inside a commercial landscape crowded with criminal look-alikes, which makes attribution slower and murkier for everyone trying to sort it out afterward.

How RATs get inside: the initial access techniques used against government targets

Phishing still does most of the heavy lifting, though calling it "phishing" undersells how tailored these lures have gotten. In November 2024, the group tracked as TA397 (also known as Bitter APT) sent a Turkish defense organization a decoy PDF themed around the World Bank, paired with a shortcut file and hidden PowerShell code, to deliver two RATs called WmRAT and MiyaRAT. Nebulous Mantis runs a similar playbook with RomCom, using weaponized document links against NATO-aligned agencies. IronHusky disguised a malicious MMC script as a Word document to deliver MysterySnail RAT. None of this is especially clever as tradecraft; it's just aimed with care, at people who won't think twice before opening a file that looks like their job.

Government employees make good targets for a boring reason: they handle a huge volume of external documents as part of a normal workday. Policy papers, procurement paperwork, interagency memos, the general slog of bureaucratic correspondence. A lure disguised as an international organization or an allied agency doesn't need to be clever. It needs to be plausible, and plausible is cheap to fake when everyone's inbox already looks like that.

Public-facing infrastructure is the other main door in. UNC5174 got into U.S. defense and UK government networks by exploiting known bugs in F5 and ConnectWise products. Salt Typhoon walked into telecom infrastructure, systems government agencies rely on every day, through network edge devices, and did it using legitimate system tools instead of dropping a payload perimeter defenses might actually catch. Nothing got flagged at the front door because nothing new arrived. The attacker just used what was already sitting there.

Then there's the low-tech option that somehow still works: NjRAT spreads through infected USB drives, a method aimed specifically at Middle Eastern government environments where air-gapped or restricted networks are common enough that removable media stays part of the daily routine. No single entry point owns this landscape. Defenders who cover phishing alone, or edge devices alone, are covering maybe a third of what's actually coming at them.

How RATs establish and maintain persistence once inside a government network

Getting in is the easy part, relatively speaking. Staying in without anyone noticing is the actual craft, and it's where most of the engineering effort goes. The standard toolkit: registry run keys and scheduled tasks that survive a reboot, process names disguised to blend with normal system activity, and multi-stage dropper chains that keep the delivery mechanism separate from the implant itself. UNC5174's SNOWLIGHT dropper installs a backdoor called VShell entirely in memory, so it leaves almost nothing on disk for an analyst to trip over later.

That in-memory trick deserves a beat of its own, because it's a real evasion leap, not a minor tweak. Traditional antivirus, and plenty of default EDR setups, hunt for files. VShell doesn't leave one behind in any lasting way, so it's basically invisible to tools built on the assumption that malware has to live somewhere on disk. It doesn't. It just visits.

On the network side, C2 traffic gets dressed up to look like nothing at all. RomCom encrypts its communications so beacon traffic blends into ordinary HTTPS flows, the same protocol carrying a thousand legitimate connections at once. MysterySnail's operators showed something more telling still: when defenders blocked their HTTP-based version, they built a WebSocket variant, nicknamed MysteryMonoSnail, instead of packing it in. That's not a static tool sitting untouched on some server. That's a team actively responding to whoever's trying to stop them.

Volt Typhoon is the case worth remembering. CISA, NSA, and the FBI documented the group holding minimal activity after gaining access, essentially going dormant except for the occasional discovery scan, while keeping a foothold across communications, energy, transportation, and water sector networks for years at a stretch. Years, not months. Government networks make this kind of patience easier than it has any right to be: sprawling environments full of legacy systems nobody can patch quickly, legitimate remote administration tools already running that make malicious traffic hard to tell apart from routine work, and staff turnover so constant that whoever might've spotted the anomaly six months ago has already moved to a different job. An attacker who's waited a year doesn't need to break in again. They just decide it's time.

Lateral movement and privilege escalation inside government infrastructure

Once inside, the move is rarely some dramatic exploit chain. Group-IB's 2024 data found that remote services, the MITRE ATT&CK technique labeled T1021, accounted for 23.9% of all observed lateral movement, roughly a quarter of everything tracked. That's exactly the channel RATs are built to exploit. Using legitimate remote access tools and protocols to hop between systems is close to the entire job description.

Credential theft feeds this directly. RATs like NjRAT and AsyncRAT come with keylogging and credential harvesting baked in, so an attacker builds up a stash of real, valid logins while moving through a network. Valid credentials moving between systems look almost identical to a sysadmin doing routine maintenance. No malware signature, no obvious tell, just someone with the right password logging into the right server at a reasonable-looking hour.

One case from Palo Alto Networks' Unit 42 complicates the usual mental picture of "one attacker, one campaign." Between June and August 2025, Unit 42 tracked three separate China-aligned threat clusters, using different RATs including one called FluffyGh0st, all targeting the same Southeast Asian government organization. Different actors, different tools, one shared target. That pattern points to either coordinated tasking or access brokering, where one group's foothold gets sold or handed off to another group with entirely different goals. UNC5174 did exactly this in 2024, selling access to compromised U.S. defense and UK government networks it had already broken into. The first attacker's job was just cracking the door. Who walks through next is a separate deal entirely.

Government network architecture makes all of this easier than it should be. Interagency systems, shared directories, federated authentication all exist because government IT is built for interoperability, not zero-trust segmentation. High trust between systems is a feature right up until one endpoint gets compromised, at which point it becomes a liability that spreads. Salt Typhoon's intrusion shows exactly how far that liability can stretch: lateral movement through telecom infrastructure eventually reached the systems used for lawful intercept, meaning the wiretapping apparatus itself. That's an adversary getting a direct look at who intelligence and law enforcement were already watching.

What government networks offer that makes them worth the operational cost of a RAT campaign

Financial data expires fast. A stolen credit card number is worth something for a few weeks, until the bank cancels it. Diplomatic cables, defense planning documents, personnel files, and policy deliberations don't work that way. They hold value for years, sometimes decades, and that shift changes the entire math of the intrusion. Salt Typhoon's access to lawful wiretap systems illustrates this cleanly: knowing which targets are already under surveillance is a counterintelligence windfall that doesn't decay the way a stolen password does.

Volt Typhoon's stated objective, per the joint CISA, NSA, and FBI advisory, isn't fast exfiltration at all. It's long-term persistence inside critical infrastructure (communications, energy, transportation, water) held in reserve for some future crisis. The Office of the National Cyber Director has framed PRC cyber objectives in similar terms: holding U.S. and allied infrastructure at risk, and shaping U.S. decisions during a moment of geopolitical tension. Once you accept that framing, patient RAT campaigns stop looking strange. They start looking like exactly what a rational actor would build, given enough time and a long enough memory.

It's not only nation-states doing this math, either. Financially motivated groups target government too, and the numbers back it up: Sophos reported that 34% of state and local government organizations got hit by ransomware in 2024, with average recovery costs reaching $2.83 million per incident. RATs frequently sit upstream of that damage, setting up the access that a separate ransomware crew later cashes in on. It's a supply chain, more or less. Just an illegal one, with worse customer service.

Government also gets hit sideways, through the vendors that serve it. Telecom carriers and defense contractors are targets precisely because they're a shortcut to government communications that never requires touching a government network directly. Salt Typhoon compromised nine of the largest U.S. telecom providers, putting government communications within reach without a single agency network ever serving as the entry point. Weigh that against the cost of running a RAT campaign (mostly cheap infrastructure and time) and the asymmetry gets hard to ignore: one successful long-dwell intrusion can pay off for years, at a fraction of what it costs to defend against.

The RAT families most consistently active against government targets

AsyncRAT keeps showing up everywhere, and the numbers back up the impression: Check Point's State of Cyber Security 2025 report ranked it the 6th most prevalent malware family globally in 2024, and Recorded Future found it the single most common malware across most regions it tracks. Its open-source roots make it trivial to fork and reshape, which is a big part of why it refuses to go away.

Remcos sits consistently in the global top five per Group-IB, hitting roughly 3% of organizations in 2024. It started life as a commodity tool, but sophisticated actors have adopted it too, which says something about how blurry the line between "criminal" and "state-sponsored" tooling has become.

PlugX, in its RedDelta variant, has real staying power. China-linked RedDelta used it against Mongolia's Ministry of Defense in August 2024 and against the Communist Party of Vietnam that November. A RAT family surviving that long usually means someone's actively maintaining and modifying it, not a group getting lucky twice in a row.

RomCom belongs to Nebulous Mantis, a Russian-nexus group running continuous campaigns against NATO-linked organizations since mid-2022, known for living-off-the-land tricks and encrypted C2 that hides in plain sight. MysterySnail RAT, IronHusky's implant, now accepts close to 40 distinct commands and targets Russian and Mongolian government bodies. Its pivot to a WebSocket variant the moment the HTTP version got blocked is a small but telling sign that there's a live dev team behind it, not just a dusty toolkit.

VShell, tied to UNC5174, runs entirely in memory and gets described on criminal forums as an upgrade over Cobalt Strike, which is a strange kind of compliment to receive. Sysdig detected more than 40 indicators of compromise linked to it in 2025 alone. NjRAT keeps grinding away against Middle Eastern government targets, spreading through both phishing and USB drives, which matters most in networks where internet access is deliberately restricted. And APT36, also called Transparent Tribe, has been targeting Indian government and defense systems with Linux-capable variants aimed at BOSS Linux, a distribution widely used across Indian agencies. That last one is worth sitting on for a second: RATs expanding past Windows means the old assumption that Linux boxes are somehow safer by default needs to get retired.

What ties all of these together isn't the code, honestly. It's the lifespan: long operational runs, steady version updates, and quick pivots the moment a defender manages to block one specific technique.

Why standard government security postures leave RATs room to operate

Legacy infrastructure is the constraint nobody gets to fix quickly. Plenty of government agencies run systems that can't be patched on any fast cycle, whether that's budget, procurement rules, or systems so old and interconnected that touching one breaks three others. UNC5174's exploitation of known, already-disclosed bugs in F5 and ConnectWise products proves this isn't hypothetical. Patching lag gets actively weaponized, on a schedule attackers can basically set their watch to.

Perimeter defense fails against RATs almost by design, and it's worth being blunt about why. RATs come in through channels that are already trusted: an email attachment someone opens on purpose, remote access software that's supposed to be running. Once inside, the C2 traffic rides alongside normal HTTPS connections, and living-off-the-land techniques lean on system binaries that were never going to get flagged, because flagging them would mean flagging half of ordinary IT work too. A perimeter built to keep bad things out has nothing left to say once the bad thing is already inside, using the front door with a key that works.

VShell's in-memory operation exposes that gap plainly. Minimal disk artifacts means traditional antivirus, and a lot of default EDR setups, simply can't see it. Interconnected agency systems make the problem worse, since one compromised endpoint can have a blast radius spanning multiple departments through shared authentication and shared trust relationships built for convenience, never for containment. The same high-privilege service accounts that keep legitimate administration running smoothly are the exact accounts an attacker wants the moment they're inside.

Salt Typhoon's breach of lawful intercept infrastructure points at something specific to government that commercial networks never have to deal with: systems built for authorized surveillance sit at an uncomfortable crossing of legal mandate and operational security, and that tension is a vulnerability of its own. Attribution adds friction to every response, too. When a state-sponsored actor runs a commercial-style RAT, or builds something custom that mimics one, it's genuinely unclear in the first hours or days whether you're looking at a criminal intrusion or a geopolitical one. That ambiguity isn't academic. It decides which legal authority responds, which agency takes the lead, and how fast anyone's actually allowed to act.

Detection approaches that address how RATs actually behave, not just what they look like

Signature matching was built for a slower malware landscape, and 384 new commercial RAT varieties showing up in a single year means that model is behind before a defender even opens a laptop. Every section above points at the same conclusion: RATs succeed by looking legitimate, by riding on trusted tools, trusted credentials, trusted network paths. So the question has to shift from "what does this file look like" to "what is this process actually doing right now."

Behavioral detection is the practical answer, and it means watching for patterns instead of fingerprints. A legitimate remote administration tool suddenly reaching out to an IP address it's never touched before. A service account logging in at 3 a.m. from a location it's never used. PowerShell spawning out of a document viewer, which has no business happening, ever. None of these show up as malware signatures. They're behavioral anomalies, and catching them means knowing what "normal" looks like across a network complicated enough that normal is a moving target most days.

Memory forensics matters more now precisely because tools like VShell were built to beat disk-based detection. If nothing gets written to disk, the fight moves into memory: process injection, odd memory allocation patterns, processes running with no matching file on disk at all. That's a genuinely harder problem than scanning files for known bad hashes, and it needs tooling most agencies weren't budgeted for a decade ago.

Network traffic analysis rounds it out. Less about blocking known-bad domains, more about noticing when encrypted traffic patterns don't match the applications supposedly generating them. RomCom's beacon traffic hides inside normal HTTPS flows on purpose. Catching it means watching timing, volume, and destination patterns, not trying to crack open the payload itself.

None of this is a single fix, and it's worth resisting the urge to pretend otherwise. MysterySnail's operators switched protocols the moment their first channel got blocked. Volt Typhoon stayed dormant for years specifically to dodge alarms tuned for immediate activity. Defending government networks against RATs isn't a problem anyone solves once and walks away from. It's a posture: assume something's already inside, assume it's willing to wait, and build detection around the kind of behavior that patience can't fully hide.