Grey Noise | Is that RAT crawling or beaconing? Remote Access Trojans 101
Summary: GreyNoise explains that Remote Access Trojans communicate with command and control servers through beaconing, which can arrive over IRC, random UDP packets, Discord bots, or the Gopher protocol, while crawling is a server scanning known IP addresses for machines that have installed RATs. The article uses gh0st RAT crawler traffic, identified by a common hex-encoded header the crawler sends, to show that results include both routine scanning by security companies and traffic from anonymous, possibly malicious servers.
What's compelling: A crawler hitting your network is asking whether a RAT is installed and answering back - so if your machines respond, you may be looking at a successful connection and need to check for exfiltration, not just close out the alert.
Read the original at GreyNoise Blog ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026