Remcos RAT Phishing Campaign Abusing Google Cloud Storage (storage.googleapis.com) with RegSvcs.exe Process Hollowing — Threadlinqs Intelligence
As of 2026-05-30, Remcos RAT Phishing Campaign Abusing Google Cloud Storage (storage.googleapis.com) with RegSvcs.exe Process Hollowing is a high-severity phishing threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0409 · Severity: HIGH · Status: MONITORING · Category: PHISHING
Attribution: N/A · FINANCIAL
ANY.RUN, Cybersecurity News, and GBHackers have disclosed an active phishing campaign abusing storage.googleapis.com buckets (pa-bids, com-bid, contract-bid-0, in-bids, out-bid) to host fake Google
Overview
--------
In April 2026, ANY.RUN, Cybersecurity News, GBHackers, and Cyberpress published analyses of an ongoing Remcos RAT phishing campaign that abuses Google Cloud Storage (storage.googleapis.com) to host intermediate payloads and fake Google Drive sign-in pages. The campaign is not a new vulnerability; it is a weaponization of trusted SaaS hosting for payload delivery and credential theft, coupled with a signed-binary-proxy execution chain that terminates in process hollowing of RegSvcs.exe (the Microsoft .NET Services Installation utility).
Delivery and Lure
-----------------
Victims receive business-themed lures (invoices, bid packets, contract attachments) that link to storage.googleapis.com URLs such as storage.googleapis.com/com-bid/GoogleDrive.html and storage.googleapis.com/pa-bids/*. Because storage.googleapis.com is a Google-owned domain with a valid TLS certificate and high reputation score, URL-reputation email security gateways and browser SmartScreen-style reputation engines do not flag the links. The HTML page renders a pixel-accurate clone of the Google Drive login experience. Submitted credentials are exfiltrated to an attacker-controlled endpoint, after which the page serves a JScript file named Bid-Packet-INV-Document.js (archived inside a ZIP with a document-lookalike icon).
Stage 1 - JScript Dropper
-------------------------
When the victim double-clicks the .js file, wscript.exe is invoked. The JScript is heavily obfuscated (string concatenation, base64-encoded blobs, character-code reconstruction) and resolves to a PowerShell command executed via powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden. This stage maps to T1059.005 (Visual Basic / JScript) and T1027 (Obfuscated Files or Information).
Stage 2 - PowerShell Downloader
-------------------------------
The PowerShell stage (observed file DYHVQ.ps1) downloads an encrypted binary blob from another storage.googleapis.com bucket (contract-bid-0, in-bids, out-bid rotated), writes it to %APPDATA%\WindowsUpdate\ZIFDG.tmp, decodes it with a simple XOR/AES routine (T1140 Deobfuscate / Decode Files), and executes it. Persistence is installed via HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run (T1547.001 Registry Run Keys).
Stage 3 - RegSvcs.exe Process Hollowing
---------------------------------------
The ZIFDG.tmp loader spawns a suspended instance of the signed Microsoft binary RegSvcs.exe (%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe), unmaps its image, writes the Remcos RAT PE into the cleared memory region using NtUnmapViewOfSection + WriteProcessMemory + SetThreadContext + ResumeThread, and resumes execution. This matches T1055.012 (Process Hollowing) and T1218 (Signed Binary Proxy Execution) via the trusted .NET utility. Because RegSvcs.exe is Microsoft-signed and whitelisted by most EDR reputation engines, behavioural signatures rather than reputation must catch the execution.
Remcos RAT Post-Exploitation
----------------------------
Remcos is a commercial Remote Control and Surveillance tool sold by Germany-based Breaking Security, widely abused by cybercrime actors since 2016. Capabilities observed in this campaign: keylogging (T1056.001), screenshot capture, credential theft from browsers (T1555.003), clipboard monitoring (T1056.004), and file exfiltration over the C2 channel (T1041 Exfiltration Over C2 Channel). The Remcos configuration beacons to 198.187.29.19 on TCP 2404 (the default Remcos port range). A Remcos identifier registry key is dropped at HKEY_CURRENT_USER\Software\Remcos-{random 8-char ID}.
Infrastructure Abuse
--------------------
Five Google Cloud Storage buckets have been identified as weaponized: pa-bids, com-bid, contract-bid-0, in-bids, out-bid. Bucket names mimic procurement / bidding vocabulary to blend with the business lure. Google's abuse response typically removes reported buckets within 24-72 hours, but the operator rotates to freshly provisioned buckets usin
Weaknesses (CWE)
CWE-20, CWE-601, CWE-829
Target sectors: financial, government, construction, manufacturing, legal, professional-services, energy, healthcare
Target regions: North America, Europe, Latin America, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1566.002, T1583.006, T1059.001, T1059.005, T1204.002, T1547.001, T1055.012, T1218, T1027, T1140