Some trojans are written the way they connect to some fixed or dynamic address. It is technically possible to write a system which connects to attacker address when ie. TWS is started.
But that approach is not very useful. And it is extremely risky. The attacker has to wait in remote address...