RAT Race: Cybercriminals Hijack Trusted Tools for Sneaky Attacks in 2025
Cybercriminals are turning legitimate remote access tools into their own personal welcome mats. Cofense Intelligence reports that these tools, intended for IT professionals, are now a hacker favorite. ConnectWise ScreenConnect is leading the charge, showing up in 56% of attacks. Remember: just because a tool has a suit and tie, doesn’t mean it’s not up to no good!
Hot Take:
Well, looks like cybercriminals have taken the old adage “if you can’t beat ’em, join ’em” to heart. Instead of crafting new tools, they’ve decided to just borrow the ones we already trust. It’s like borrowing your neighbor’s lawnmower, except instead of trimming the hedges, they’re trimming down your company’s security.
Key Points:
- Cybercriminals are increasingly using legitimate Remote Access Tools (RATs) for attacks.
- These tools are designed for lawful purposes, making them harder to detect.
- ConnectWise ScreenConnect is the most commonly abused RAT, with 56% of attacks in 2024.
- Attackers use methods like spoofing emails to trick victims into installing RATs.
- RAT campaigns are often one-off events, posing ongoing challenges for cybersecurity.
Already a member? Log in here