Proofpoint suggests that tRat is part of a trend of malware becoming more modular in order to provide attackers with more value in the long haul.