T-RAT Malware Threat Intel Advisory

CloudSEK Threat Intelligence Advisory on T-RAT, uses Telegram as its Command & Control channel, capable of keylogging, screen capture, etc.
Updated on
April 19, 2023
Published on
October 29, 2020
Subscribe to the latest industry news, threats and resources.
Command & Control
Target Platform
  T-RAT is a Windows remote access trojan (RAT) that uses Telegram as a Command & Control (C2) channel to monitor the victims and steal their private data. The author of the malware highlights the integration capabilities of T-RAT as a selling point. This feature allows the malware to control the infected hosts and makes it easy to use.   Users of T-RAT can enter their commands by typing them in the chat window of the VoiP, instant messaging app Telegram. More than ninety commands are available at the user’s disposal and they are capable of performing the following functions:
  • File system navigation
  • Keylogging
  • Audio recording
  • Screen capture
  • Webcam monitoring
  • Clipboard access
This malware is also capable of interacting with Windows operating system via PowerShell and CMD, to manipulate running processes especially those which are security related. A second Command & Control channel is provided in the RAT via RDP/ VNC. T-RAT is also capable of hijacking crypto transactions leveraging the clipboard access feature, to target payment solutions like:
  • Qiwi
  • WMR
  • WMZ
  • WME
  • WMX
  • Yandex Money
  • Payeer
  • CC
  • BTC
  • BTCG
  • Ripple
  • Dogecoin
  • Tron
T-RAT is being sold on various Russian speaking underground forums, with graphics illustrations of its features, the major selling point being Telegram integrations, used for C2 communications, making it easy to deploy the malware.  T-RAT Malware Threat Intel Advisory[/vc_wp_text][vc_wp_text]


  • Private data and credentials are compromised.
  • Full [unauthorized] access to file systems and services. 
  • Privacy violation due to compromise of peripheral devices like webcam and microphone.
  • Adding the victims to the botnet to further the attack (DDoS) against potential targets.
  • Enables attackers to make digital fingerprints of their victims.
  • Corporate endpoints are exploited to gain access to internal networks.
  • VPN access can be compromised via keylogging.


  • Use EDR solutions to prevent such attacks.
  • Cyber hygiene and user awareness are critical to enhance security.
  • Beware of emails that come with suspicious attachments (Office doc/ PDF).

Get Global Threat Intelligence on Real Time

Protect your business from cyber threats with real-time global threat intelligence data.. 30-day free and No Commitment Trial.
Schedule a Demo
Real time Threat Intelligence Data
More information and context about Underground Chatter
On-Demand Research Services
Dashboard mockup
Global Threat Intelligence Feed

Protect and proceed with Actionable Intelligence

The Global Cyber Threat Intelligence Feed is an innovative platform that gathers information from various sources to help businesses and organizations stay ahead of potential cyber-attacks. This feed provides real-time updates on cyber threats, including malware, phishing scams, and other forms of cybercrime.
Trusted by 400+ Top organisations