Exploiting Legitimate Remote Access Tools in Ransomware Campaigns

### Executive Summary This report details how legitimate Remote Access Tools are misused as enablers for ransomware campaigns, providing a stage-by-stage kill-chain analysis (credential compromise, RAT deployment/hijack, persistence, antivirus neutralization, payload execution, lateral movement, and impact), practical detection indicators and command examples, MITRE ATT&CK mappings, real-world campaign associations (e.g., LockBit, Makop), and defensive recommendations such as restricting RAT usage, enforcing MFA, and behavioral detection.