Creepy Ratters – men who secretly spy on “slaves” via webcams and remote administration toolsets

// March 12th, 2013 // Hacking and Security


Unwitting victim of a ratter works on her pc while ratter spies on her via her webcam

They use a set of tools called “remote administration tools” (RAT).  They call themselves “ratters” and they taunt, prank, and toy with their prey, typically young females.  They use underground forums to share the spoils of their efforts, hundreds of gigabytes worth of photos of their “slaves”.  And they may be watching you, through your webcam, without you ever knowing it.

Ratters use tools such as DarkComet and BlackShades that are installed on victim’s machines as malware.  They work hard to overcome their single biggest obstacle – the webcam light that goes on when the camera is in use (entire threads exist containing discussions on how to defeat the light or lists of laptop and camera models that do not have a lighted webcam).  To build their army of “slaves”, they must first trick the victim into installing the malware.  They do this by seeding the malware on file sharing torrent networks (with an attractive name like “Beanie Babies” to attract females), by friending victims on Facebook and convincing them to open the infected file (typically promoted as a picture or a song), or by running a fake website (often virtual) that distributes the malware.

“The first time I use a slave’s cam, I send a fake message saying something like the cam software is updating and the light may come on and go off periodically.  But obviously in a more windows-like way of saying it!”

Once a victim is compromised  they may even sell the slave to another ratter or “rent” them to another ratter for a specific period of time (and for a set amount of money).  Some even give their slaves away on popular forums in a “Free Girl Slave Giveaway”.

The slaves themselves often never realize their machine has been compromised – at least until the ratter becomes bored with the slave and begins to taunt them.

“A man came up and saw that his webcam was on, he then put the middle finger up to me lmao [laughing my ass off].  I then went to remote desktop and he had lots of pornography up, but he was also freaking out and scanning his computer with two different anti-virus programs. It was pretty funny, but he actually managed to remove the infected server from his PC, he used some ‘ad-ware’ software which managed to remove it.”

Ars Technica described one real-life incident where a man and woman discover that their PC has been infected by a ratter.


The woman is visible from thousands of miles away on a hacker’s computer. The hacker has infected her machine with a remote administration tool (RAT) that gives him access to the woman’s screen, to her webcam, to her files, to her microphone. He watches her and the baby through a small control window open on his Windows PC, then he decides to have a little fun. He enters a series of shock and pornographic websites and watches them appear on the woman’s computer.

The woman is startled. “Did it scare you?” she asks someone off camera. A young man steps into the webcam frame. “Yes,” he says. Both stare at the computer in horrified fascination.

“I think someone hacked into our computer,” says the young man.

Far away, the hacker opens his “Fun Manager” control panel, which provides a host of tools for messing with his RAT victims. He can hide their Windows “Start” button or the taskbar or the clock or the desktop, badly confusing many casual Windows users. He can have their computer speak to them. Instead, he settles for popping open the remote computer’s optical drive.

Even over the webcam, the sound of shock is clear. “Stay right here,” says the woman.

“Whoa!… the DVD thing just opened,” says the young man.

The hacker sends the pair a message that reads “achoo!” and the young man laughs in astonishment. “Disconnect from the Internet,” he says. “Your laptop’s going to go kaboom next.”


Here are some sample ratter screenshots that have been posted on underground forums.

Ratter stream of a "slave" victim


Ratter victim covers up webcam with piece of tape


Ratters catch people in unflattering positions


RAT (remote access toolset) screenshot showing many slaves


Sources: Ars Technica, Daily Mail, AlterNet, Business Insider
Geek wear at Ivy and Pearl Boutique

« « Previous Article: New study goes back 11,300 years to chart Earth’s global temperature changes – things just got worse     » » Next Article: Samsung Galaxy S4 fizzle but device does solidify position as king of the mobile arena – for now…

Leave a Reply

You must be logged in to post a comment.

%d bloggers like this: