Among remote access and loader tools, several RAT and Trojan families continue to dominate underground discussions and sales activity, reflecting their ongoing role as first-stage infection mechanisms. Figure 1 illustrates the steady level of RAT activity observed across dark web forums and marketplaces, incorporating trends in mentions, listings, and related infection telemetry. All subsequent graphs in this section draw on the same dataset, representing aggregated deep and dark web mentions, marketplace listings, recent activity, and observed infections.
In contrast, general malware activity (as seen below) across the underground shows consistent volume with periodic surges around newly released stealer kits and ransomware variants.
Emerging malware trends and tools from 2025
New and evolving malware families continue to…
