RemcosMalware
- remcosrat
- remvio
- socmer
Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers. Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns. Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.From MISP Galaxy
Last reported 2 days ago, by Group-IB16 reports
ATT&CK techniques
6 of 120 · each with the sentence it comes from- T1056.001Keylogging
“T1056.001”
- T1055Process Injection
“T1055”
- T1027Obfuscated Files or Information
“T1027”
- T1036Masquerading
“Masquerading: Masquerade Task or Service”
- T1055.012Process Hollowing
“T1055.012”
- T1684Social Engineering
“Access to timely intelligence on emerging malware families, attacker infrastructure, delivery methods, and social engineering trends can help you identify risks sooner and respond more proactively.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
16 reports, newest first · the exact sentence from each-
Inside SiriusQT: A Seriously Skilled RAT“SiriusQT has been observed in relation to other malware families, such as Remcos, XWorm, AsyncRAT and QuasarRAT/NJRAT, since SiriusQT operators may rely on shared or reused infrastructure.”
-
Beware of phishing emails disguised as quote requests“The decrypted and executed payload downloads Remcos RAT—the final piece of malware—from the C2 server into memory.”
-
Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests“At this point, the loader operates by receiving the C2 server address—from which it will download the Remcos RAT—as an argument value.”
-
Cyber Brief 26-06 - May 2026“OpenClaw skill supply-chain compromise delivered Remcos RAT and GhostLoader”
-
July 2026 Infostealer Trend Report“ACRStealer AGENTTESLA 동향 Infostealer 정보탈취 악성코드 LummaC2 Remcos Remus Vidar”
-
Cruciferra Crypter Uses Process Ghosting to Evade Detection“…, was first offered for sale on the Exploit forum in autumn 2025 and now underpins dozens of campaigns delivering AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger.”
-
The TTF Trap: A Global Campaign of a Low-Detection Lua Loader“…ination of fileless techniques and Lua-based loaders with low detection rates to deploy various malware families, including Agent Tesla, Remcos, XWorm, and Best Private LOGGER.”
-
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement“… analysis of C2 netflow data revealed that suspected China- and India-nexus threat actors operating PlugX, ShadowPad, Cobalt Strike, and Remcos infrastructure have converged on this victim class.”
-
SmartApeSG Launches Okendo Reviews Supply Chain Attack“SmartApeSG activity commonly leads to the deployment of remote access trojans (RATs) such as NetSupport and Remcos, or information stealers such as StealC.”
-
WebDAV-as-a-Service: The Infrastructure Behind Emmenhtal“Over 100 WebDAV servers delivered a wide range of payloads including DarkGate, Amadey, Lumma, Remcos and many others.”
-
Malicious OpenClaw Skill Distributes Remcos RAT and GhostLoader“Malicious OpenClaw Skill Distributes Remcos RAT and GhostLoader”
-
BlindEagle Targets Colombian Government Agency with Caminho and DCRAT“Known examples include AsyncRAT variants and other .NET tools such as Remcos.”
-
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Three“| 0x2C | enable_browser_cleaning_only_for_the_first_run_flag | Enable web browsers cleaning only on the first run of Remcos |”
-
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part One“In this example, it is %ProgramData%\Remcos\remcos.exe.”
-
Traders’ dollars in danger: CVE-2023-38831 zero-day vulnerability in WinRAR exploited by cybercriminals to target traders“A ZIP archive was crafted to deliver various malware families: DarkMe, GuLoader, Remcos RAT”
-
BLISTER Loader“…mework; in addition, Elastic has also observed BLISTER in relation to the following families: Amadey, BitRAT, Clipbanker, Cobalt Strike, Remcos, and Raccoon along with others.”
Thanks — we review every report.