CRAT is a plugin-capable remote access trojan (RAT) attributed to the Lazarus Group, a sophisticated threat actor linked to North Korea. First observed in May 2020 by Cisco Talos researchers, this Windows-targeted malware establishes persistent backdoor access to compromised machines, allowing attackers to execute commands, steal data, and expand their toolkit through modular plugins. Unlike commodity malware sold on underground forums, CRAT represents targeted intrusion software used in campaigns against organizations and individuals of strategic interest. If you've been flagged by antivirus for CRAT or discovered suspicious remote access activity on your Windows PC, you're dealing with a serious threat that requires immediate attention.
Threat Profile
| Malware Name | CRAT |
|---|---|
| Classification | Remote Access Trojan (RAT) / Backdoor |
| Target Platform | Windows (PE executable) |
| First Observed | May 2020 |
| Attribution | Lazarus Group (APT38 / HIDDEN COBRA) |
| File Type | Windows PE32/PE32+ executable |
| Distribution Method | Targeted spearphishing, strategic web compromises, supply chain attacks |
| Persistence Mechanism | Registry run keys, scheduled tasks, service installation |
| Primary Capability | Remote command execution with modular plugin architecture |
| Detection Names | Varies across engines (CRAT, Lazarus RAT, generic backdoor signatures) |
| Severity Level | High — enables full system compromise and lateral movement |
| Data at Risk | Credentials, financial records, intellectual property, network access tokens |
How It Spreads
CRAT infections typically begin with highly targeted delivery methods rather than mass distribution. The Lazarus Group invests significant reconnaissance effort into identifying valuable targets—often organizations in the financial, defense, cryptocurrency, or technology sectors. Unlike ransomware operations that cast wide nets, CRAT deployments are precision strikes designed to establish long-term access for espionage or financial theft operations.
The initial infection vector frequently involves spearphishing emails crafted with detailed knowledge of the target. These messages may reference legitimate business relationships, ongoing projects, or industry-specific concerns to establish credibility. Attachments often masquerade as business documents (contracts, invoices, technical specifications) while actually containing executable payloads or weaponized Office documents with malicious macros. In some campaigns, attackers compromise legitimate websites frequented by target demographics—a technique called strategic web compromise or watering hole attacks—and serve CRAT through browser exploitation or social engineering prompts.
Common distribution methods include:
- Spearphishing attachments — malicious executables disguised as PDF files, archive contents presented as business documents, or macro-enabled Office files
- Strategic web compromises — legitimate industry websites injected with exploit code or fake software updates
- Supply chain attacks — compromised software installers or updates from third-party vendors
- Social engineering — direct messaging via LinkedIn or professional platforms with links to malicious payloads
- Lateral movement — deployment to additional machines after initial network penetration using stolen credentials
What It Does On Your Machine
Once executed, CRAT establishes itself as a persistent backdoor with the primary goal of maintaining covert access to your system. The malware typically creates multiple persistence mechanisms to survive reboots and security software removal attempts. Registry run keys ensure the malware launches with Windows startup, while scheduled tasks provide redundant execution triggers. In enterprise environments, attackers may install CRAT as a Windows service to blend with legitimate system processes and maintain execution even in safe mode.
The trojan's modular architecture allows operators to extend functionality through plugins delivered after initial compromise. This design keeps the initial payload smaller and harder to detect while providing flexibility to adapt capabilities based on the specific target environment. Core functionality includes command execution, file system access, screen capture, keylogging, and network reconnaissance. The plugin system allows attackers to add specialized modules for credential harvesting, lateral movement tools, or data exfiltration utilities without redeploying the entire malware package.
CRAT establishes command-and-control (C2) communications with attacker-operated servers, typically using encrypted channels to evade network monitoring. The malware periodically beacons to these servers, checking for new commands or plugin updates. When operators connect to an infected system, they gain an interactive remote shell with privileges equivalent to the compromised user account—often administrator or SYSTEM level in successful attacks. This access allows real-time interaction: browsing your files, monitoring your screen, recording keystrokes, accessing your browser's saved passwords, and pivoting to other machines on your network.
The data theft capabilities pose severe risks depending on how you use your computer. For home users, CRAT can harvest banking credentials, tax documents, personal photos, and email archives. For small business owners, the threat extends to customer databases, financial records, proprietary business information, and credentials for critical services. The Lazarus Group has demonstrated particular interest in cryptocurrency wallets and exchanges—if you hold or transact in digital currencies, CRAT infections can result in direct financial theft through wallet access or transaction manipulation.
Manual Removal — Step by Step
Disconnect From Network Immediately
Before attempting any removal, physically disconnect the infected computer from your network. Unplug the Ethernet cable and disable Wi-Fi through the hardware switch (not just Windows settings). CRAT provides real-time remote access—staying connected allows attackers to observe your remediation efforts and deploy countermeasures. For business networks, also notify your IT administrator or security team before proceeding.
Boot Into Safe Mode With Networking
Restart the computer and enter Safe Mode with Networking (press F8 during boot on older systems, or use Settings > Update & Security > Recovery > Advanced Startup on Windows 10/11). Safe Mode loads only essential drivers and services, which may prevent CRAT from executing its full persistence mechanisms. The "with Networking" option allows you to download tools if needed while still limiting most malware functionality.
Document Current System State
Before making changes, capture screenshots of any suspicious processes in Task Manager (Ctrl+Shift+Esc), note unusual startup items using Task Manager's Startup tab, and document any unfamiliar scheduled tasks (search for "Task Scheduler" in Start menu). This documentation helps if you need professional assistance and provides evidence for potential incident reporting if business or sensitive data was compromised.
Run Reputable Antimalware Scans
Download and run full system scans with at least two reputable security tools: Windows Defender (built-in) plus a secondary scanner like Malwarebytes Free or ESET Online Scanner. Use custom scan settings to examine all drives and archive files. CRAT's modular nature means components may be scattered across multiple locations. Allow scans to complete fully—this may take several hours for systems with large drives. Quarantine or delete all identified threats.
Manually Check Persistence Locations
Even after antimalware scans, manually inspect common persistence locations. Open Registry Editor (regedit.exe) and examine HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for unfamiliar entries. Check Task Scheduler for tasks you didn't create. Review Windows Services (services.msc) for suspicious entries with generic names or descriptions. Delete anything unrecognized, but document first—removing legitimate entries can cause system instability.
Clear Temporary Directories
CRAT often stages files in temporary folders. Navigate to %TEMP%, %LOCALAPPDATA%\Temp, and C:\Windows\Temp. Sort by date modified and look for recently created executables or archives with random names. Delete suspicious files, then empty the Recycle Bin. Also clear browser caches and download folders, as initial infection vectors may persist there.
Change All Passwords — From a Different Device
Since CRAT includes keylogging capabilities and can harvest stored credentials, assume all passwords entered on the infected machine are compromised. Using a separate clean device (phone, tablet, or different computer), change passwords for email, banking, social media, work accounts, and any other critical services. Enable two-factor authentication wherever available. Do not change passwords on the infected machine—even after cleaning—until you've verified complete removal.
Monitor Financial Accounts and Credit
Given Lazarus Group's financial theft objectives, closely monitor bank accounts, credit card statements, and cryptocurrency wallets for unauthorized transactions. Consider placing fraud alerts with credit bureaus if the infected machine had access to tax documents, financial records, or personally identifiable information. For business systems, review any transactions processed or financial transfers initiated during the infection period.
Consider Full System Reinstallation
Given CRAT's sophisticated nature and state-sponsored backing, the only way to guarantee complete removal is full system reinstallation from clean media. Back up important data files (documents, photos—not executables or system files) to external media, scan the backup thoroughly on a clean system, then perform a clean Windows installation. This is especially critical for business systems, machines with financial access, or any computer where sensitive data was present during infection.
Restore and Verify
After reinstallation (or if confident in scan-based removal), reconnect to the network cautiously. Install all Windows updates immediately to patch vulnerabilities. Restore data from your scanned backup. Monitor system behavior closely for several days—watch for unexpected network activity, unfamiliar processes, or performance degradation. Run periodic antimalware scans over the following weeks to catch any remnants that might reactivate.
Prevention
- Maintain skepticism toward unsolicited emails — even messages appearing to come from known contacts. Verify unexpected attachments or links through separate communication channels before opening. Lazarus Group spearphishing campaigns demonstrate extensive research into targets, making messages appear highly legitimate.
- Disable macros by default in Microsoft Office applications and only enable for documents from verified trusted sources. Many CRAT delivery campaigns rely on weaponized Office documents. Configure Office to require explicit approval before enabling macros rather than trusting documents by default.
- Keep Windows and all software current with security patches. Enable automatic updates for Windows, browsers, PDF readers, and other commonly exploited applications. Lazarus campaigns often incorporate zero-day exploits, but patching known vulnerabilities eliminates a significant attack surface.
- Use robust endpoint protection beyond Windows Defender for business environments or high-value targets. Enterprise-grade solutions with behavioral detection, application whitelisting, and network monitoring provide better defense against sophisticated threats. For home users, Windows Defender combined with safe computing practices provides baseline protection.
- Implement network segmentation for business environments. Separate guest networks from production systems, isolate financial workstations, and limit lateral movement opportunities. If CRAT compromises one machine, segmentation prevents automatic spread across your entire infrastructure.
- Establish backup procedures with offline storage — maintain regular backups stored disconnected from network-accessible systems. Ransomware often follows initial CRAT compromise in multi-stage attacks. Offline backups provide recovery options if infections escalate beyond data theft to system destruction.
- Monitor outbound network traffic for unusual patterns. CRAT requires C2 communications to function effectively. Network monitoring that flags connections to unknown foreign servers, unusual encryption protocols, or unexpected data volumes can detect infections before significant damage occurs.
- Restrict administrative privileges — operate with standard user accounts for daily tasks, elevating to administrator only when necessary. CRAT's capabilities expand significantly with administrative access, enabling service installation, deeper persistence mechanisms, and broader system control.
Bring It In
CRAT infections represent a different threat category than typical malware. This isn't adware bundled with freeware or a mass-distributed ransomware variant—it's targeted intrusion software deployed by a well-resourced threat actor with specific objectives. The manual removal steps outlined above provide guidance for technically confident users, but the risks of incomplete removal are substantial. Hidden persistence mechanisms, rootkit components, or secondary payloads deployed alongside CRAT can remain even after seemingly successful cleaning. For business systems, machines with financial access, or computers containing sensitive personal information, professional forensic analysis and remediation provides the only reliable path to security.
Computer Repair Roswell has handled advanced persistent threats for Roswell-area businesses and residents for over a decade. We maintain isolated forensic workstations for infected system analysis, use enterprise-grade detection tools unavailable in consumer products, and follow documented remediation procedures that address both the immediate infection and underlying security gaps. Bring your computer to our shop at 1335 Hembree Road in Roswell, or call (770) 954-1960 to discuss your situation. We provide upfront pricing, typically complete CRAT remediation within 24-48 hours, and deliver your system with security configurations that reduce reinfection risk. Don't gamble with sophisticated state-sponsored malware—let professionals with the right tools and experience handle it correctly the first time.