The name "Ratty" is a double entendre. First, it is a nod to its function as a Remote Access Trojan (R.A.T.). Second, it refers to the bot’s behavioral pattern: like a rat, it stays hidden in the basement (kernel level) of the operating system, chews through data wires (network protocols), and reproduces rapidly across network shares.
Attackers published three malicious packages to the NPM registry (used by millions of JavaScript developers) named url-resolve-ratty , axios-fix-rat , and load-env-rat . These packages contained the Cheese Loader. Developers who downloaded these packages inadvertently introduced Ratty Bot into their CI/CD pipelines, leading to supply chain attacks on three major retail chains. Ratty Bot
The new version is rumored to use a small language model (SLM) to generate unique, human-like HTTP request headers for every single infected machine, making fingerprinting nearly impossible. Furthermore, the v3.0 roadmap mentions a "Lateral Gnaw" feature that uses LLM chatbots to generate convincing phishing emails tailored to the specific employee being targeted, using data scraped from the local machine. The Ratty Bot represents the maturation of the cybercrime economy. It is not a script kiddie tool; it is enterprise-grade malicious software designed to evade modern defenses. The name may sound harmless, but the impact is devastating: downtime, regulatory fines for data leaks, and loss of customer trust. The name "Ratty" is a double entendre