Loading story…
Researchers and incident reports show Remcos RAT continuing to spread through multiple delivery channels, including business-themed phishing emails, fake cryptocurrency software, and multi-stage script loaders. Trend Micro documented a phishing campaign using an ACE archive attachment and an AutoIt-based loader to install Remcos Professional 1.7, while ESET reported a spoofed SafeMoon application that delivered Remcos to cryptocurrency users. SonicWall later identified a newer infection chain using VBScript, batch files, PowerShell, and a .NET loader to deploy Remcos after patching AMSI and ETW for defense evasion, with observed targeting of European institutions.
Technical analysis from Elastic Security Labs found that modern Remcos samples retain extensive remote-access and surveillance functions, including keylogging, screenshots, audio capture, webcam access, shell command execution, password theft, browser-history collection, persistence, process injection, and UAC bypass. Elastic recovered most of the malware’s configuration structure and command set, showing that Remcos stores encrypted settings, supports TLS-enabled command-and-control, can masquerade as legitimate processes such as explorer.exe, and can clean browser artifacts or uninstall itself on command. The reporting underscores how a tool originally marketed for red teaming has become a widely abused malware family with increasingly evasive delivery chains and mature post-compromise control features.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
K7 Labs analyzed a Remcos RAT infection chain delivered through a malicious .vhd file containing a shortcut that launched PowerShell, performed an AMSI bypass, created a scheduled task, and fetched additional staged payloads disguised as PNG, PDF, and image files. The final .NET DLL hollowed out RegAsm.exe to launch Remcos, whose RC4-encrypted SETTINGS resource revealed C2, persistence, and surveillance capabilities.
A security blog described recent Remcos distribution methods using executable payloads that abuse vbc.exe and schtasks.exe, and ISO/image-based payloads that use UAC bypass, easinvoker.exe, and execution from mounted media paths such as \\Device\\CdRom. The report also published file hashes, domains, IP addresses, and SIEM detection logic for identifying this activity.
Splunk Threat Research analyzed a Remcos loader chain in which a VBScript downloader fetched a second-stage script from paste.ee, decoded Remcos, shellcode, and dynwrapx.dll, then used DynamicWrapperX and regsvr32 to inject the RAT into winhlp32.exe. Splunk correlated related VirusTotal behavior beginning on 2021-09-12 and later observed similar activity shifting from winhlp32.exe to installutil.exe.
A Reddit user first reported the malicious SafeMoon-lookalike domain that was later used to distribute Remcos malware. This report was cited by ESET as occurring in August 2021.
SonicWall reported an updated infection chain delivering Remcos RAT through a VBScript, obfuscated batch file, PowerShell, and .NET loader that patches both AMSI scanning and ETW logging for stealth. The company assessed that the campaign appears to target European institutions and noted the same loader had previously distributed Async RAT.
Elastic Security Labs published a follow-on REMCOS analysis describing its configuration structure and command-and-control functionality. Researchers said they recovered about 80% of configuration fields and about 95% of the command set, and documented a custom conf-tool for extracting and modifying configurations.
Elastic Security Labs published the first part of its REMCOS analysis, covering version 4.9.3 Pro execution flow, RC4-decrypted SETTINGS configuration, UAC bypass, installation, persistence, process injection, and browser-cleaning behavior. The report described how the malware can masquerade as explorer.exe, disable UAC, copy itself into a hidden install directory, and relaunch from there.
Cybercriminals used Discord messages advertising a fake SafeMoon app update to direct users to a spoofed SafeMoon website whose download link delivered a Windows executable, Safemoon-App-v2.0.6.exe. Executing the installer dropped Remcos and related malware components on victim systems.
In July, Trend Micro observed a phishing campaign using the subject line "RE: NEW ORDER 573923" and an ACE archive attachment named "Purchase order201900512.ace" to deliver Remcos RAT. The archive contained an AutoIt-based loader, "Boom.exe," which dropped and executed Remcos Professional 1.7.
FortiGuard Labs analyzed a phishing spam campaign that delivered Remcos RAT through a password-protected ZIP archive containing a Windows shortcut file disguised as a text document. The LNK launched PowerShell to fetch a second-stage script that dropped Remcos 2.5.0 Pro, which renamed itself sysclient.exe, established registry persistence, used process hollowing, and communicated with RC4-encrypted C2 servers.
ESET reported that US authorities issued an official alert about Remcos shortly after the tool was released. The reference does not provide the exact release date or alert date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
any.run
Open sourcesonicwall.com
Open sourceelastic.co
Open sourceelastic.co
Open sourcewelivesecurity.com
Open sourcefortinet.com
Open sourcetrendmicro.com
Open sourceapp.any.run
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Remcos RAT** continues to appear as a full-featured remote access implant delivered by loaders and malicious email attachments, with analysts documenting a .NET-packed sample that unpacked in memory and deployed **Remcos PRO 2.7.2**. In the observed infection chain, the malware established persistence with a scheduled task, dropped and ran a VBS script from the Temp directory, copied itself into `AppData\Roaming\remcos\`, and then removed the script. Recovered configurations exposed operational settings including execution and log paths, mutex values, encryption keys, and at least one command-and-control endpoint at `185.244.26.209`. Technical analysis shows Remcos is built for long-term control and surveillance, with capabilities spanning file, process, service, registry, window, and power management, plus remote shell access, script execution, password recovery, proxying, and download-and-execute behavior. Researchers also described a watchdog mechanism that can inject into processes such as `svchost.exe`, store the main process PID in the registry, and relaunch the implant if it is killed. The malware supports offline keylogging, screenshot capture, and audio recording, stores and decrypts configuration data from a `SETTINGS` PE resource using **RC4**, and communicates with configured C2 infrastructure using a structured packet format with optional TLS and embedded certificate material; one demonstration showed an operator issuing command `0x94` to change a Notepad window title.
Aug 15, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026