In the last three decades there have been significant changes in the cybercrime world in terms of organization, type of attacks, and tools. Remote access trojans (RATs) are an intrinsic part of traditional cybercriminal activities, however they have also become a standard tool in advanced espionage attacks and in scams.

The overly specialized research in our community on RATs has resulted in a seeming lack of general perspective and understanding as to how RATs have evolved as a phenomenon. The lack of a more generalist research hinders the understanding and development of new techniques and methods to better detect them.

This work presents a new generalist perspective on remote access trojans, an analysis of their growth in the last 30 years, and a discussion of how they have become a commodity in the last decade. We found that the number of RATs increased drastically in the past ten years and that, nowadays, they have become standardized commodity products that are not very different from each other.

This talk will focus on three specific aspects of our research. First, we will present the first and most comprehensive timeline of the last 30 years of RATs. Second, we will present an overview of the commoditization of the most well-known RATs in 2019-2020. Third, we will discuss the types of attacks and attackers using RATs.