NetSupport RAT is frequently exploited by threat actors for various malicious purposes. One common use is data exfiltration, where the RAT is used to locate and extract sensitive information, such as, credentials, financial data, and critical documents. It also enables credential harvesting through keylogging or theft of browser-stored data, which can provide attackers with access to additional systems or accounts. Once inside a network, attackers leverage the RAT’s capabilities to facilitate lateral movement, compromising additional systems and expanding their control. Furthermore, NetSupport RAT often serves as a dropper, deploying other malware such as ransomware or secondary backdoors to escalate the attack’s impact.