How many computers were infected with rat trojans in 2024

Checked on January 2, 2026
Disclaimer: Factually can make mistakes. Please verify important information or breaking news. Learn more.

Executive summary

No authoritative public source quantified “how many computers were infected with RAT trojans in 2024”; available reporting documents rising RAT activity and many high-volume detections of malware generally, but does not add up to a verified global infection total for RATs specifically [1] [2] [3].

1. What the question is actually asking and why it matters

Asking “how many computers were infected with RAT trojans in 2024” seeks a single, global metric of infections, a figure governments, industry and consumers could use to assess scale and risk, but that figure would require consistent definitions (what counts as a RAT infection versus a legitimate remote‑access tool), universal telemetry across operating systems and clouds, and transparent sharing of detections—conditions the public reporting ecosystem does not provide [4] [5].

2. What the collected reporting actually says about RAT activity in 2024

Multiple industry reports portray RATs as a growing and prominent threat during 2024: Recorded Future says RATs such as AsyncRAT, XWorm and Remcos rose in prominence and marked a tactical shift in H1 2024 [3], Darktrace reports roughly a 30% increase in RAT activity between the first and last halves of 2024 [1], and vendor blogs and quarterly threat indexes recount specific waves — for example Remcos being distributed via VHD files in March 2024 and DarkGate, Async and XWorm featuring in many delivery chains that year [6] [5] [7].

3. Proxies and partial data that hint at scale — but do not equal a global count

Security vendors published large numbers that are suggestive but not RAT‑specific: Kaspersky’s Q2 2024 telemetry registered 27,394,168 malicious and potentially unwanted objects detected by file antivirus [2], and industry trackers list RAT families among the top malware seen in quarterly rankings [7] [8]; Bitsight later reported RATs were the second most common malware sold on underground forums in 2024, with hundreds of unique malware varieties traded overall [9]. These figures show millions of malware detections and hundreds of RAT variants in circulation, but none provide a defensible numerator for “computers infected with RATs in 2024” because detections, variants, and unique infected hosts are different metrics [2] [9].

4. Why producing a single infection number is infeasible with current reporting

Counting infected computers globally requires deduplication across vendor telemetry, cross‑platform visibility, and a shared taxonomy; instead the ecosystem has fragmented signals: RATs often masquerade as legitimate remote tools or are sold as dual‑use products, detection varies by vendor and region, and many infections remain covert or unreported to public datasets—points explicitly noted by vendors and analysts who document stealthy delivery chains, gray‑market tooling and the blurred line between legitimate remote access software and RATs [5] [4] [10].

5. Bottom line — the most accurate answer available from the reporting

There is no verifiable public tally of “how many computers were infected with RAT trojans in 2024”; reporting instead documents a clear increase in RAT activity, many millions of general malware detections across vendors in 2024, and the widespread circulation of dozens to hundreds of RAT variants — data that indicate a large problem but stop short of a single infection count [1] [2] [9]. Any precise number quoted without coordinated, cross‑vendor evidence would be speculative; informed conclusions should therefore rely on trend indicators (rising activity, prominent RAT families, millions of malware detections) rather than a false sense of numeric precision [3] [6] [7].

Want to dive deeper?
How do security vendors measure and report malware infections and why do their numbers differ?
Which RAT families were most active or notable in 2024 and what industries were targeted?
What methods do analysts use to estimate unique infected hosts from vendor telemetry and why are those estimates uncertain?