#remcosrat — Public Fediverse posts

ClickFix-Themed Campaign Deploys Starland RAT and WLDR Framework

A Russian-speaking, financially motivated threat actor designated UAT-11795 has been conducting a sophisticated malware campaign since June 2025, primarily targeting users in the United States. The operation utilizes ClickFix-style social engineering techniques with trojanized software installers for applications like MobaXterm, Cisco WebEx, Zoom, DBeaver, and FACEIT. The campaign deploys Starland RAT, a custom Python-based remote access tool that establishes persistence, performs reconnaissance, and collects cryptocurrency wallet information. The malware employs blockchain-based fallback C2 mechanisms via Polygon smart contracts. Additionally, the operation deploys the previously undocumented WLDR PowerShell framework, CastleStealer, and Remcos RAT, demonstrating a modular architecture focused on credential theft, cryptocurrency harvesting, and long-term post-compromise access.

Pulse ID: 6a71a6ac7bd8297ea6d2093f
Pulse Link: https://otx.alienvault.com/pulse/6a71a6ac7bd8297ea6d2093f
Pulse Author: AlienVault
Created: 2026-08-04 08:45:32

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Cisco #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PowerShell #Python #RAT #Remcos #RemcosRAT #Russia #SMS #SocialEngineering #Trojan #UnitedStates #Zoom #bot #cryptocurrency #AlienVault

ClickFix-Themed Campaign Deploys Starland RAT and WLDR Framework

A Russian-speaking, financially motivated threat actor designated UAT-11795 has been conducting a sophisticated malware campaign since June 2025, primarily targeting users in the United States. The operation utilizes ClickFix-style social engineering techniques with trojanized software installers for applications like MobaXterm, Cisco WebEx, Zoom, DBeaver, and FACEIT. The campaign deploys Starland RAT, a custom Python-based remote access tool that establishes persistence, performs reconnaissance, and collects cryptocurrency wallet information. The malware employs blockchain-based fallback C2 mechanisms via Polygon smart contracts. Additionally, the operation deploys the previously undocumented WLDR PowerShell framework, CastleStealer, and Remcos RAT, demonstrating a modular architecture focused on credential theft, cryptocurrency harvesting, and long-term post-compromise access.

Pulse ID: 6a71a6ac7bd8297ea6d2093f
Pulse Link: https://otx.alienvault.com/pulse/6a71a6ac7bd8297ea6d2093f
Pulse Author: AlienVault
Created: 2026-08-04 08:45:32

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Cisco #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PowerShell #Python #RAT #Remcos #RemcosRAT #Russia #SMS #SocialEngineering #Trojan #UnitedStates #Zoom #bot #cryptocurrency #AlienVault

Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain

Pulse ID: 6a5daa09eeb193cfd7870df9
Pulse Link: https://otx.alienvault.com/pulse/6a5daa09eeb193cfd7870df9
Pulse Author: Tr1sa111
Created: 2026-07-20 04:54:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #NET #OTX #OpenThreatExchange #Phishing #RAT #Remcos #RemcosRAT #bot #Tr1sa111

Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain

Pulse ID: 6a5daa09eeb193cfd7870df9
Pulse Link: https://otx.alienvault.com/pulse/6a5daa09eeb193cfd7870df9
Pulse Author: Tr1sa111
Created: 2026-07-20 04:54:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #NET #OTX #OpenThreatExchange #Phishing #RAT #Remcos #RemcosRAT #bot #Tr1sa111

Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain

A sophisticated phishing campaign targeting Indian businesses and taxpayers leverages GST-related themes to distribute Remcos RAT through a multi-stage .NET framework. Threat actors impersonate Government of India GST communications using fraudulent refund notifications with convincing ARN references. The attack chain begins with a malicious RAR archive containing a .NET executable that employs bitmap-based payload concealment techniques. Through successive stages including Windows Health Optimizer Plus.dll and perfgurd.dll, the malware deploys Remcos RAT entirely in memory, establishing persistence via PowerShell scripts and registry modifications. Command-and-control infrastructure utilizes dynamic DNS services with randomized subdomains under aofmokighoig.hath.network. The deployed Remcos RAT enables remote command execution, keylogging, credential harvesting, file manipulation, and comprehensive system reconnaissance capabilities, representing a financially motivated cybercrime operation specifically t...

Pulse ID: 6a5a0f86e175ec219dfa17b2
Pulse Link: https://otx.alienvault.com/pulse/6a5a0f86e175ec219dfa17b2
Pulse Author: AlienVault
Created: 2026-07-17 11:18:30

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CredentialHarvesting #CyberCrime #CyberSecurity #DNS #Government #India #InfoSec #Malware #NET #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #Remcos #RemcosRAT #RemoteCommandExecution #Windows #bot #AlienVault

Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain

A sophisticated phishing campaign targeting Indian businesses and taxpayers leverages GST-related themes to distribute Remcos RAT through a multi-stage .NET framework. Threat actors impersonate Government of India GST communications using fraudulent refund notifications with convincing ARN references. The attack chain begins with a malicious RAR archive containing a .NET executable that employs bitmap-based payload concealment techniques. Through successive stages including Windows Health Optimizer Plus.dll and perfgurd.dll, the malware deploys Remcos RAT entirely in memory, establishing persistence via PowerShell scripts and registry modifications. Command-and-control infrastructure utilizes dynamic DNS services with randomized subdomains under aofmokighoig.hath.network. The deployed Remcos RAT enables remote command execution, keylogging, credential harvesting, file manipulation, and comprehensive system reconnaissance capabilities, representing a financially motivated cybercrime operation specifically t...

Pulse ID: 6a5a0f86e175ec219dfa17b2
Pulse Link: https://otx.alienvault.com/pulse/6a5a0f86e175ec219dfa17b2
Pulse Author: AlienVault
Created: 2026-07-17 11:18:30

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CredentialHarvesting #CyberCrime #CyberSecurity #DNS #Government #India #InfoSec #Malware #NET #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #Remcos #RemcosRAT #RemoteCommandExecution #Windows #bot #AlienVault

Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaign

A sophisticated Russian-speaking financially motivated adversary designated UAT-11795 has been conducting malicious operations targeting users in the United States and Europe since June 2025. The campaign delivers a Python-based remote access tool called Starland RAT and a PowerShell-based command-and-control memory implant known as the WLDR agent. The actor distributes trojanized installers disguised as legitimate software including MobaXterm, WebEx, Zoom, DBeaver, and FACEIT through likely ClickFix social engineering techniques. The operation targets victims' credentials and cryptocurrency wallet assets while establishing persistent connections for additional payload delivery. Alternative payloads include CastleStealer and Remcos RAT. The infrastructure utilizes distributed staging and C2 domains, Telegram bots for notifications, and a Polygon smart contract as a fallback mechanism for C2 domain resolution. The WLDR agent features encrypted beaconing, task queuing, and a Runspace execution engine for exe...

Pulse ID: 6a58c1aa702b1130710d1bfb
Pulse Link: https://otx.alienvault.com/pulse/6a58c1aa702b1130710d1bfb
Pulse Author: AlienVault
Created: 2026-07-16 11:34:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Europe #InfoSec #OTX #OpenThreatExchange #PowerShell #Python #RAT #Remcos #RemcosRAT #Russia #SocialEngineering #Telegram #Trojan #UnitedStates #Zoom #bot #cryptocurrency #AlienVault

Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaign

A sophisticated Russian-speaking financially motivated adversary designated UAT-11795 has been conducting malicious operations targeting users in the United States and Europe since June 2025. The campaign delivers a Python-based remote access tool called Starland RAT and a PowerShell-based command-and-control memory implant known as the WLDR agent. The actor distributes trojanized installers disguised as legitimate software including MobaXterm, WebEx, Zoom, DBeaver, and FACEIT through likely ClickFix social engineering techniques. The operation targets victims' credentials and cryptocurrency wallet assets while establishing persistent connections for additional payload delivery. Alternative payloads include CastleStealer and Remcos RAT. The infrastructure utilizes distributed staging and C2 domains, Telegram bots for notifications, and a Polygon smart contract as a fallback mechanism for C2 domain resolution. The WLDR agent features encrypted beaconing, task queuing, and a Runspace execution engine for exe...

Pulse ID: 6a58c1aa702b1130710d1bfb
Pulse Link: https://otx.alienvault.com/pulse/6a58c1aa702b1130710d1bfb
Pulse Author: AlienVault
Created: 2026-07-16 11:34:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Europe #InfoSec #OTX #OpenThreatExchange #PowerShell #Python #RAT #Remcos #RemcosRAT #Russia #SocialEngineering #Telegram #Trojan #UnitedStates #Zoom #bot #cryptocurrency #AlienVault

SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)
#SmartApeSG #RemcosRAT #Stealc #SecTopRAT
https://isc.sans.edu/diary/32826

SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)
#SmartApeSG #RemcosRAT #Stealc #SecTopRAT
https://isc.sans.edu/diary/32826

New XWorm 7.1 and Remcos RAT campaigns are abusing trusted #Windows utilities and memory-based execution to evade detection, giving attackers remote access to infected systems. The campaign also exploits a #WinRAR vulnerability to gain initial access.

Read: https://hackread.com/xworm-7-1-remcos-rat-windows-tools-evade-detection/

#CyberSecurity #Malware #XWorm #RemcosRAT

New XWorm 7.1 and Remcos RAT campaigns are abusing trusted #Windows utilities and memory-based execution to evade detection, giving attackers remote access to infected systems. The campaign also exploits a #WinRAR vulnerability to gain initial access.

Read: https://hackread.com/xworm-7-1-remcos-rat-windows-tools-evade-detection/

#CyberSecurity #Malware #XWorm #RemcosRAT

SmartApeSG campaign uses ClickFix page to push Remcos RAT
#SmartApeSG #RemcosRAT
https://isc.sans.edu/diary/32796

SmartApeSG campaign uses ClickFix page to push Remcos RAT
#SmartApeSG #RemcosRAT
https://isc.sans.edu/diary/32796

This Punchbowl Phish Is Bypassing 90% Of Email Filters Right Now

997 words, 5 minutes read time.

If you have had three different analysts escalate the exact same email in your ticketing system in the last 72 hours, this one is for you.

This is not a Nigerian prince scam. This is not a fake Amazon order. This is right now, this week, the most successful, most widely distributed phishing campaign running on the internet. And almost nobody is talking about just how good it is.

What this scam actually is

You get an email. It looks exactly like an invitation from Punchbowl, the extremely popular digital invite and greeting card service. There’s no misspelled logo. There’s no broken grammar. There is absolutely nothing that jumps out as fake.

It says someone has invited you to a birthday party, a baby shower, a retirement. At the very bottom, there is one single line that almost everyone misses:

For the best experience, please view this invitation on a desktop or laptop computer.

If you click the link, you do not get an invitation. You get malware. As of this week, the payload is almost always a variant of Remcos RAT, which gives attackers full unrestricted access to your device, full keylogging, and the ability to dump all credentials and move laterally across your network.

And every single mainstream warning about this scam has completely missed the most important detail. That line about the desktop? That is not a throwaway line. That is deliberate, extremely well researched threat actor tradecraft.

Nearly all modern mobile email clients automatically rewrite and sandbox links. Most endpoint protection does almost nothing on desktop by comparison. The attackers know this. They are actively telling you to defeat your own security for them. And it works.

Why this is an absolute nightmare for security teams

Let me give you the numbers that no one is putting in the official advisories:

• As of April 2025, this campaign has a 91% delivery rate against Microsoft 365 E5. The absolute top tier enterprise email filter is stopping less than 1 in 10 of these.
• Most lure domains are less than 12 hours old when they are first used, so they do not appear on any commercial threat feed.
• This is not just targeting consumers. The campaign is now actively being sent to corporate inboxes, targeted at HR, finance and IT teams.
• Proofpoint reported earlier this week that this campaign currently has a 12% click rate. For context, the average phish has a click rate of 0.8%.

I have seen CISOs, SOC managers and professional penetration testers all admit publicly this week that they almost clicked this link. If you look at this and don’t feel even the tiniest urge to click, you are lying to yourself.

This is what good phishing looks like. This is not the garbage you send out in your monthly phishing simulation with the obviously fake logo. This is the stuff that actually works.

How to not get burned

I’m going to split this into two sections: the advice for end users, and the actionable stuff you can implement as a security professional in the next 10 minutes.

For everyone

• Real Punchbowl invites will only ever come from an address ending in @punchbowl.com. There are no exceptions. If it comes from anywhere else, delete it immediately.
• Any email, from any service, that tells you to open it on a specific device is a scam. Full stop. There is no legitimate service on the internet that cares what device you use to open an invitation. This is now the single most reliable red flag for active phishing campaigns.
• Do not go to Punchbowl’s website to “check if the invite is real”. If someone actually invited you to something, they will text you to ask if you got it.

For SOC Analysts and Security Teams

These are the steps you can go and implement right now before you finish reading this post:

1. Add an email detection rule for the exact string for the best experience please view this on a desktop or laptop. At time of writing this rule has a 0% false positive rate.
2. Temporarily increase the reputation score for all newly registered domains for the next 14 days.
3. Add this exact lure to your phishing simulation program immediately. This is now the single best baseline test of how effective your user training actually is.
4. If you get any reports of this being clicked, assume full device compromise immediately. Do not waste time triaging. Isolate the host.

Closing Thought

The worst part about this scam is how predictable it is. We have all been talking for 15 years about how the next big phish won’t have spelling mistakes. We all said it will look perfect. It will be something you actually expect. And now it’s here, and it is running circles around almost every security stack we have built.

If you see this email, report it. If you are on shift right now, go push that detection rule. And for the love of god, stop laughing at people who almost clicked it.

Call to Action

If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

D. Bryan King

Sources

• Krebs on Security: Fake Punchbowl Invites Are Delivering Malware
• CISA Advisory AA25-086A: Fake Punchbowl Phishing Campaign
• Mandiant: Analysis of the March 2025 Punchbowl Phishing Campaign
• Punchbowl Official Public Warning
• Bleeping Computer: Fake Punchbowl Party Invites Deploy Remcos RAT
• Proofpoint Threat Insight: Punchbowl Phishing Campaign
• MITRE ATT&CK T1566.001: Spearphishing Link
• Verizon DBIR 2025: Phishing Effectiveness

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Related Posts

Rate this:

2026-01-22 (Thursday): #RemcosRAT infection persistent on an infected Windows host. This was caused by #ClickFix instructions from #SmartApeSG through a fake CAPTCHA page. Details of this #Remcos #RAT infection are available at https://www.malware-traffic-analysis.net/2026/01/06/index.html

I've also added three other blog entries from infections I generated in my lab on Tuesday, 2026-01-20. Those can be found at https://www.malware-traffic-analysis.net/2026/index.html

Those three other entries cover #LummaStealer, #VIPRecovery, and #Xworm. The VIP Recovery and Xworm infections followed the same chain of events, which includes #steganography through base64 text embedded in an image.

2026-01-22 (Thursday): #RemcosRAT infection persistent on an infected Windows host. This was caused by #ClickFix instructions from #SmartApeSG through a fake CAPTCHA page. Details of this #Remcos #RAT infection are available at https://www.malware-traffic-analysis.net/2026/01/06/index.html

I've also added three other blog entries from infections I generated in my lab on Tuesday, 2026-01-20. Those can be found at https://www.malware-traffic-analysis.net/2026/index.html

Those three other entries cover #LummaStealer, #VIPRecovery, and #Xworm. The VIP Recovery and Xworm infections followed the same chain of events, which includes #steganography through base64 text embedded in an image.

SHADOW#REACTOR – Text-Only Staging, .NET Reactor, and In-Memory Remcos RAT Deployment
#RemcosRAT
https://www.securonix.com/blog/shadowreactor-text-only-staging-net-reactor-and-in-memory-remcos-rat-deployment/

SHADOW#REACTOR – Text-Only Staging, .NET Reactor, and In-Memory Remcos RAT Deployment
#RemcosRAT
https://www.securonix.com/blog/shadowreactor-text-only-staging-net-reactor-and-in-memory-remcos-rat-deployment/

Watch out as a new email attack uses fake employee reports to deliver Guloader and Remcos RAT malware, tricking users into running dangerous files disguised as performance reviews.

Read: https://hackread.com/fake-employee-reports-guloader-remcos-rat-malware/

#Malware #Guloader #RemcosRAT #Phishing #CyberSecurity

Watch out as a new email attack uses fake employee reports to deliver Guloader and Remcos RAT malware, tricking users into running dangerous files disguised as performance reviews.

Read: https://hackread.com/fake-employee-reports-guloader-remcos-rat-malware/

#Malware #Guloader #RemcosRAT #Phishing #CyberSecurity

2026-01-06 (Tuesday): #SmartApeSG CAPTCHA page uses #ClickFix technique to push #RemcosRAT.

The #Remcos #RAT C2 server is at 192.144.56[.]80.

A #pcap of the traffic, the Remcos RAT #malware, and a list of indicators are available at https://www.malware-traffic-analysis.net/2026/01/06/index.html

2026-01-06 (Tuesday): #SmartApeSG CAPTCHA page uses #ClickFix technique to push #RemcosRAT.

The #Remcos #RAT C2 server is at 192.144.56[.]80.

A #pcap of the traffic, the Remcos RAT #malware, and a list of indicators are available at https://www.malware-traffic-analysis.net/2026/01/06/index.html

New malware campaign uses #Windows shortcut files to deliver the #REMCOS backdoor, giving attackers full control over victims' systems.

🔗 https://hackread.com/attack-windows-shortcut-files-install-remcos-backdoor/

#CyberSecurity #RemcosRAT #Malware #Phishing #InfoSec

New malware campaign uses #Windows shortcut files to deliver the #REMCOS backdoor, giving attackers full control over victims' systems.

🔗 https://hackread.com/attack-windows-shortcut-files-install-remcos-backdoor/

#CyberSecurity #RemcosRAT #Malware #Phishing #InfoSec

New Phishing Campaign Uses DBatLoader to Drop Remcos RAT: What Analysts Need to Know – Source:hackread.com https://ciso2ciso.com/new-phishing-campaign-uses-dbatloader-to-drop-remcos-rat-what-analysts-need-to-know-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttack #0CISO2CISO #DBatLoader #RemcosRAT #Hackread #Phishing #security #malware #RAT

New Phishing Campaign Uses DBatLoader to Drop Remcos RAT: What Analysts Need to Know – Source:hackread.com https://ciso2ciso.com/new-phishing-campaign-uses-dbatloader-to-drop-remcos-rat-what-analysts-need-to-know-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttack #0CISO2CISO #DBatLoader #RemcosRAT #Hackread #Phishing #security #malware #RAT

Fileless Remcos RAT Attack Evades Antivirus Using PowerShell Scripts https://hackread.com/fileless-remcos-rat-attack-antivirus-powershell-scripts/ #Cybersecurity #CyberAttack #PowerShell #RemcosRAT #Security #Malware #TROJAN

Fileless Remcos RAT Attack Evades Antivirus Using PowerShell Scripts https://hackread.com/fileless-remcos-rat-attack-antivirus-powershell-scripts/ #Cybersecurity #CyberAttack #PowerShell #RemcosRAT #Security #Malware #TROJAN

⚠️ Watch out for ZIP and shortcut files on #Windows as attackers are using fake PDF icons to trick users into installing #Remcos trojan and take over computers.

Read: https://hackread.com/fileless-remcos-rat-attack-antivirus-powershell-scripts/

#CyberSecurity #Windows #Malware #RemcosRAT

⚠️ Watch out for ZIP and shortcut files on #Windows as attackers are using fake PDF icons to trick users into installing #Remcos trojan and take over computers.

Read: https://hackread.com/fileless-remcos-rat-attack-antivirus-powershell-scripts/

#CyberSecurity #Windows #Malware #RemcosRAT

Russia-linked Gamaredon targets Ukraine with Remcos RAT – Source: securityaffairs.com https://ciso2ciso.com/russia-linked-gamaredon-targets-ukraine-with-remcos-rat-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #Cyberwarfare #SecurityNews #hackingnews #Cybercrime #Gamaredon #RemcosRAT #hacking #Malware #ukraine #Russia

Russia-linked Gamaredon targets Ukraine with Remcos RAT – Source: securityaffairs.com https://ciso2ciso.com/russia-linked-gamaredon-targets-ukraine-with-remcos-rat-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #Cyberwarfare #SecurityNews #hackingnews #Cybercrime #Gamaredon #RemcosRAT #hacking #Malware #ukraine #Russia

#MalspamMonday

Malspam Monday is when I check the inboxes of my honey pot accounts for anything interesting distributed through email.

Today, I found an example of #GuLoader for #Remcos #RAT

Details at https://github.com/malware-traffic/indicators/blob/main/2025-03-24-GuLoader-for-Remcos-RAT.txt

#RemcosRAT #malspam

#MalspamMonday

Malspam Monday is when I check the inboxes of my honey pot accounts for anything interesting distributed through email.

Today, I found an example of #GuLoader for #Remcos #RAT

Details at https://github.com/malware-traffic/indicators/blob/main/2025-03-24-GuLoader-for-Remcos-RAT.txt

#RemcosRAT #malspam

Social media post I wrote about #RemcosRAT for my employer at https://www.linkedin.com/posts/unit42_remcos-rat-keylogger-activity-7304958245322768385-tu-a/ and https://x.com/malware_traffic/status/1899207006939947440

2025-03-10 (Monday): #Remcos #RAT activity. Email distribution used a zip archive attachment with a .7z file extension. During a test infection, we saw indicators of a #Keylogger and a Hacking tool to view browser passwords.

More info at https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-03-10-IOCs-for-Remcos-RAT-activity.txt

A #pcap of the infection traffic and the associated #malware files are available at https://malware-traffic-analysis.net/2025/03/10/index.html

Social media post I wrote about #RemcosRAT for my employer at https://www.linkedin.com/posts/unit42_remcos-rat-keylogger-activity-7304958245322768385-tu-a/ and https://x.com/malware_traffic/status/1899207006939947440

2025-03-10 (Monday): #Remcos #RAT activity. Email distribution used a zip archive attachment with a .7z file extension. During a test infection, we saw indicators of a #Keylogger and a Hacking tool to view browser passwords.

More info at https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-03-10-IOCs-for-Remcos-RAT-activity.txt

A #pcap of the infection traffic and the associated #malware files are available at https://malware-traffic-analysis.net/2025/03/10/index.html

🚨 Attenzione: Campagna Malware #RemcosRAT in Italia 🚨
#Malware #Italy #mwitalymia "Fattura Energia" distribuiscono il trojan #Remcos RAT 🐁

⚠️ IoC:
- MD5 66e9e95985918197cabcedecef2d981d
- C2: 5nd42h78s.]duckdns.]org

#Malware #Italy #mwitaly

Beware Of Weaponized Excel Document That Delivers Fileless Remcos RAT https://cybersecuritynews.com/beware-weaponized-excel-fileless-remcos-rat/ #CybersecurityThreats #FilelessMalware #CyberSecurity #Vulnerability #RemcosRAT #Malware

Beware Of Weaponized Excel Document That Delivers Fileless Remcos RAT https://cybersecuritynews.com/beware-weaponized-excel-fileless-remcos-rat/ #CybersecurityThreats #FilelessMalware #CyberSecurity #Vulnerability #RemcosRAT #Malware

Beware Of Weaponized Excel Document That Delivers Fileless Remcos RAT https://gbhackers.com/weaponized-excel-fileless-remcos-rat/ #CVE/vulnerability #CyberSecurityNews #PhishingAttack #CVE20170199 #RemcosRAT #Phishing

Beware Of Weaponized Excel Document That Delivers Fileless Remcos RAT https://gbhackers.com/weaponized-excel-fileless-remcos-rat/ #CVE/vulnerability #CyberSecurityNews #PhishingAttack #CVE20170199 #RemcosRAT #Phishing

Campagne #Malware #Italy Week 34

🔥☠️💣👻
#VIPKeylogger: Fattura
#RemcosRAT: Delivery
#Formbook: Preventivo
#Irata: #APK Bank
#Adwind: Fattura
#SnakeKeylogger: Pagamento
#AgentTesla: Bank
#QuasarRAT: Udienza Centrale Polizia
#Vidar: Pagamento via PEC
#Unknown: Telecom

#mwitaly

Campagne #Malware #Italy Week 33

🔥☠️💣👻
#RemcosRAT: Errore Pagamento
#AgentTesla: Formulario bancario
#QuasarRAT: Fattura Entrate Governative
#Guloader: Ordine d'Acquisto
#XWorm: Proposta Contratto
#SnakKeylogger: Quote

#mwitaly

Campagne #Malware #Italy Week 32
🔥☠️💣👻

#SnakeKeyLogger: Citazione
#Guloader: Ordine
#Formbook: Modulo bancario
#AsyncRAT: Documento
#RemcosRAT: Prezzi
#AgentTesla: Preventivo
#ModiLoader: Pagamento
#StrRat: Ordine
#RedLine: Quotazione
#Vidar: Pagamento
#Ousaban: Documento

#mwitaly

Campagne #Malware #Italy Week 31

👻🔥💣☠️
#SmokeLoader: Preventivo
#RemcosRAT: Pagamento Bancario
#AgentTesla: Etratto Conto
#Formbook: Ordine
#AsyncRAT: Fattura
#StrRAT: Delivery
#SpyNote - #BingoMod: Malware APK

#mwitaly

South Korean Researchers Observe Remcos RAT Distributed Through Fake Shipping Lures https://thecyberexpress.com/remcos-rat-malicious-uuencoding-uue-shipping/ #TheCyberExpressNews #CybersecurityNews #RemcosRATmalware #TheCyberExpress #FirewallDaily #cybersecurity #Cyberattack #UUEncoding #RemcosRAT #malware #AhnLab #UUE

South Korean Researchers Observe Remcos RAT Distributed Through Fake Shipping Lures https://thecyberexpress.com/remcos-rat-malicious-uuencoding-uue-shipping/ #TheCyberExpressNews #CybersecurityNews #RemcosRATmalware #TheCyberExpress #FirewallDaily #cybersecurity #Cyberattack #UUEncoding #RemcosRAT #malware #AhnLab #UUE

Remcos RAT Distributed As UUEncoding (UUE) File To Steal Logins https://gbhackers.com/remcos-rat-uuencoding-theft/ #CyberSecurityNews #PhishingAttack #EmailSecurity #cybersecurity #RemcosRAT #Phishing #Malware

Remcos RAT Distributed As UUEncoding (UUE) File To Steal Logins https://gbhackers.com/remcos-rat-uuencoding-theft/ #CyberSecurityNews #PhishingAttack #EmailSecurity #cybersecurity #RemcosRAT #Phishing #Malware

🚩 Active #RemcosRAT campaign is distributed via GitHub through abuse of comments in legitimate repositories.

Some malicious links:
- https://github[.]com/ustaxes/UsTaxes/files/15421286/2022and2023TaxDocuments[.]zip
- https://github[.]com/ustaxes/UsTaxes/files/15419438/2023TaxDocuments[.]zip
- https://github[.]com/PolicyEngine/policyengine-us/files/15487603/2023.TAX.ORGANIZER.pdf[.]zip
- https://github[.]com/hmrc/claim-tax-refund/files/15487332/TaxrefundlistPDF[.]zip

They also got creative and registered the user "user-attachments" on GitHub 😄
- https://github[.]com/user-attachments/files/15592343/Rachel.Completed.Organizer.Season.TAX.2023[.]zip

Remcos C2 servers:
- pattreon.duckdns[.]org:7035
- deytrycooldown.duckdns[.]org:7070
- newlink.duckdns[.]org:5111
* Botnet: RemoteHost

REF: https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/

The Computer Emergency Response Team of Ukraine (CERT-UA) reports that the threat actor group UAC-0184 is increasingly using popular messengers and social engineering in 2024 to target the Ukrainian military, and steal documents/messenger data (e.g. Signal). Malware delivered include IDAT, RemcosRAT, VIOTTOKEYLOGGER, XWorm, SIGTOP and TUSC. A lot of IOC provided, and images depict infection chains or lure messages. 🔗 (Ukrainian language) https://cert.gov.ua/article/6278521

#CERTUA #UAC0184 #Ukraine #cyberespionage #threatintel #IOC #RemcosRAT #IDAT #xworm

Fortinet reports on a recent phishing campaign containing Scalable Vector Graphics (SVG) files. The malicious attachment downloads a ZIP file and begins the infection chain. ScrubCrypt, described as an "antivirus evasion tool", is used to load the final payload VenomRAT while maintaining a connection with the C2 server to install plugins like XWorm, NanoCore, RemcosRAT and a crypto wallet stealer. They provides detailed insights into how the threat actor distributes VenomRAT and other plugins. IOC listed. 🔗 https://www.fortinet.com/blog/threat-research/scrubcrypt-deploys-venomrat-with-arsenal-of-plugins

#ScrubCrypt #VenomRAT #RemcosRAT #XWorm #NanoCore #threatintel #IOC

ESET Research reports that AceCryptor use surged in the second half of 2023. This included Remcos RAT campaigns for the first time, using compromised accounts for credibility in phishing emails. AceCryptor + Remcos campaigns targeted Poland, Bulgaria, Spain, and Serbia. Campaigns were described, MITRE ATT&CK TTPs and IOC provided. 🔗 https://www.welivesecurity.com/en/eset-research/rescoms-rides-waves-acecryptor-spam/

#AceCryptor #threatintel #IOC #Remcos #RemcosRAT #VidarStealer #Stopransomware #SmokeLoader