RftRAT is a remote-control malware family used by the North Korea-linked Kimsuky group against Windows systems. It appeared throughout 2023 alongside XRat and Amadey, including builds produced with AutoIt. The surrounding Kimsuky intrusion chain used spear-phishing emails containing attachments or download links that induced recipients to unpack archives and execute malicious LNK shortcuts. Those shortcuts extracted encrypted archives and launched BAT or VBS malware, after which remote-control tools such as RftRAT were installed to control compromised hosts.