Commodity RATs and Stealware: The Silent Threat to Australian Operations

In the Australian cybersecurity landscape, we often focus on the headline-grabbing ransomware groups. However, the true backbone of many modern intrusions is the commodity Remote Access Trojan (RAT). According to the Recorded Future H1 2026 report, high-frequency malware families like AsyncRAT, Cobalt Strike, and XWorm continue to dominate the threat environment. For Australian businesses, these tools are not just background noise; they are the primary engines for data theft and initial access. Understanding these threats is the first step in hardening your perimeter.

The Persistence of Commodity Tooling

Why do threat actors continue to rely on "commodity" tools when custom malware exists? The answer is accessibility and modularity. Tools like AsyncRAT and XWorm provide a feature-rich, "as-a-service" experience. They allow attackers to log keystrokes, capture screenshots, exfiltrate files, and maintain persistent backdoors with minimal technical overhead.

Cobalt Strike, while originally a legitimate penetration testing tool, remains the industry standard for post-exploitation. Its ability to blend into legitimate network traffic makes it incredibly difficult for standard signature-based antivirus solutions to detect. These tools are frequently dropped via malspam campaigns or malicious advertisements, making every endpoint in your business a potential front line.

Impact on Australian Data Sovereignty

The primary objective of these RATs is data theft. In the Australian context, this is a significant concern for compliance with the Privacy Act. When an attacker gains control via a RAT, they do not just lock your files; they steal them.

Beyond simple credential harvesting, these actors look for session cookies. By stealing browser data, they can bypass multi-factor authentication (MFA) and gain persistent access to cloud-based services like Microsoft 365 or Salesforce. For an Australian business, this constitutes a reportable data breach, potentially leading to heavy regulatory scrutiny and long-term reputational damage.

Defence Strategies and ACSC Alignment

To defend against commodity malware, you must adopt a layered strategy consistent with the Australian Cyber Security Centre (ACSC) Essential Eight framework.

• Application Control: By restricting which applications are allowed to run, you prevent unauthorized RATs from executing even if a user accidentally downloads them.
• Macro Security: Most commodity malware is delivered via weaponized documents. Disabling macros for all users—and using Group Policy to enforce this—remains the most effective way to stop the primary infection vector.
• Network Segmentation: If a RAT successfully gains a foothold, segmentation prevents that malware from "calling home" to command-and-control (C2) servers or spreading laterally across your sensitive servers.

What You Should Do

To secure your environment against these active threats, implement the following actions immediately:

• Restrict PowerShell: Audit and restrict the use of PowerShell for standard users. Use Constrained Language Mode to limit the power of malicious scripts.
• Monitor C2 Traffic: Implement DNS filtering to block communication with known malicious command-and-control domains.
• Enable MFA Everywhere: Use phishing-resistant MFA, such as FIDO2-compliant security keys, to mitigate the impact of stolen session cookies.
• Patching Cadence: Prioritize patching of internet-facing assets. Commodity RATs are frequently delivered via exploits targeting known vulnerabilities in VPNs and edge appliances.
• Audit Browser Data: Implement policies that prevent users from saving passwords in browsers, or use managed browser profiles that encrypt data at rest.

Conclusion

Commodity RATs like AsyncRAT and XWorm represent a persistent, low-barrier-to-entry threat that no Australian business can ignore. By focusing on fundamental security hygiene and adhering to the ACSC Essential Eight, you shift the odds in your favour. While you cannot stop every probe or phishing attempt, you can ensure that an attacker’s initial foothold remains a dead end rather than a bridge to your sensitive data. Stay vigilant and keep your defences patched and audited.