Multi-Stage Steganographic Loader Campaign Deploying Remcos RAT and Diverse Stealer Payloads (K7 Labs, June 2026)
Multi-Stage Steganographic Loader Campaign Deploying Remcos (TL-2026-0896), also tracked as Multi-Stage Steganographic Loader Campaign, is a high-severity malware campaign, first published 2026-06-21. It has no confirmed attribution, affects Microsoft Windows, maps to 23 MITRE ATT&CK techniques (T1027, T1027.003, T1041), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0896
- Threat ID
- TL-2026-0896
- Also known as
- Multi-Stage Steganographic Loader Campaign, Steganographic .NET Loader / Remcos delivery campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-21
- Last reviewed
- 2026-06-21
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- financial, banking, general business
- Target regions
- India, Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Multi-Stage Steganographic Loader Campaign Deploying Remcos
Malware and tooling: Remcos, Remcos RAT
An active, globally-distributed phishing campaign uses a multi-stage .NET loader chain that conceals next-stage payloads inside a serialized .NET Bitmap object embedded in a resource section, executing each stage in memory to avoid disk artifacts. The chain delivers Remcos RAT via two .NET loaders (Optimax.dll then System Optimizer Ultimate.dll); the broader operation also distributes Agent Tesla, MassLogger, Phantom Stealer, Dark Cloud, RedLine Stealer, Snake Keylogger, Formbook, and XWorm.
How Multi-Stage Steganographic Loader Campaign Deploying Remcos works
K7 Labs reported (22 June 2026) an active multi-stage steganographic loader campaign distributing a diverse set of RAT and infostealer payloads worldwide, with India-focused financial lures observed prominently.
Initial access is via phishing email carrying an archive attachment. The Stage 1 dropper is a 32-bit, packed, unsigned .NET executable masquerading as a brick-building game carrying Turkish-language artifacts (metadata string 'TuglaInsaatci', Turkish for 'brick-builder'); an observed sample was named 'GST Debit Note Apr_26.com'. The dropper retrieves a hidden next stage from its resource sections: the payload is steganographically concealed inside a serialized .NET Bitmap object stored in a resource named 'SR1', defeating naive static inspection.
The extracted Stage 2 loader, Optimax.dll (32-bit .NET), dynamically loads a subsequent .NET assembly directly from an in-memory byte array using AppDomain.Load (reflective / in-memory assembly loading), leaving no second-stage file on disk. Stage 3, 'System Optimizer Ultimate.dll', delivers the final payload — Remcos RAT — in memory. Remcos is injected via process hollowing into the system's default browser process. The fileless, staged design (steganographic resource container + reflective assembly loading + process hollowing) is engineered specifically to evade disk-based and signature detection.
The deployed Remcos RAT establishes persistence through a Run registry key, self-copies to %AppData%\Roaming under a randomized name with the super-hidden attribute, and deploys an obfuscated PowerShell (.ps1) script; the report also notes winlogon.exe execution and userinit integration. It bypasses UAC by abusing eventviewer.exe, creates the mutex 'Remcos_Mutex_Inj', and performs anti-analysis checks for the Sandboxie module sbiedll.dll and for VirtualBox via the registry path hardware\acpi\dsdt\vbox_. Remcos provides keylogging, screen capture, audio capture, webcam/video capture, peripheral discovery, and browser credential theft; collected data is written to 'logs.dat' and exfiltrated to the C2. Observed Remcos C2 endpoints are 62.102.148.212:37393 (primary), 217.138.252.123:42830, and 146.70.244.90:37393.
The campaign is not tied to a CVE; it relies on social engineering and loader tradecraft rather than software vulnerability exploitation.
MITRE ATT&CK techniques used in TL-2026-0896
Defense Evasion
T1027 Obfuscated Files or Information; T1027.003 Steganography; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1564.001 Hidden Files and Directories; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Collection
T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Command and Control
T1071 Application Layer Protocol
defense-impairment
Discovery
T1120 Peripheral Device Discovery
Persistence
T1547.001 Registry Run Keys / Startup Folder; T1547.004 Winlogon Helper DLL
privilege-escalation
T1548.002 Bypass User Account Control
Privilege Escalation
T1548.002 Bypass User Account Control
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in Multi-Stage Steganographic Loader Campaign Deploying Remcos
- Microsoft — Windows
Vulnerable versions: Windows endpoints running the .NET Framework / CLR
Remediation for Multi-Stage Steganographic Loader Campaign Deploying Remcos
Immediate actions
- Block C2 endpoints 62.102.148.212, 217.138.252.123, and 146.70.244.90 at the perimeter, including outbound TCP to ports 37393 and 42830
- Quarantine and hunt for the listed file hashes across endpoints
- Block and alert on inbound archive attachments containing .com executables masquerading as documents (e.g. 'GST Debit Note Apr_26.com')
Workarounds
- Block execution from %AppData%\Roaming via application control / WDAC policies
- Disable the eventviewer.exe UAC-bypass vector by enforcing UAC at the highest level and monitoring mscfile/Event Viewer hijack registry keys
Longer-term hardening
- Deploy EDR with behavioral detection for process hollowing into browser processes and reflective .NET assembly loading (AppDomain.Load from byte arrays)
- Enable and centrally collect Windows AMSI, PowerShell Script Block Logging, and Sysmon (process create, image load, registry) telemetry
- Enforce attachment sanitization / sandbox detonation for inbound email archives
- Restrict and monitor execution of .com files and unsigned .NET binaries from user-writable paths
Timeline of Multi-Stage Steganographic Loader Campaign Deploying Remcos
- Lure documents reference April 2026 (e.g. 'GST Debit Note Apr_26.com' / 'GST debit bill Apr 2026.com'), indicating the campaign distribution window around this period.
- K7 Labs publishes its analysis along with file-hash and network IOCs and the broader list of distributed families (Agent Tesla, MassLogger, Phantom Stealer, Dark Cloud, RedLine, Snake Keylogger, Formbook, XWorm).
- Remcos establishes persistence via a Run registry key, self-copies to %AppData%\Roaming as a super-hidden randomized file, deploys an obfuscated PowerShell script, bypasses UAC via eventviewer.exe, and creates the mutex 'Remcos_Mutex_Inj'.
- Final payload confirmed as Remcos RAT, injected via process hollowing into the default browser process with C2 at 62.102.148.212:37393, 217.138.252.123:42830, and 146.70.244.90:37393.
- Stage 3 'System Optimizer Ultimate.dll' is loaded in memory and delivers the final payload, completing the Optimax.dll -> System Optimizer Ultimate.dll loader chain.
- Stage 2 loader Optimax.dll reflectively loads the subsequent assembly in memory via AppDomain.Load from a byte array, leaving no second-stage file on disk.
- Stage 1 .com dropper executes and extracts the steganographically-concealed next stage from a serialized .NET Bitmap object stored in resource 'SR1', defeating naive static inspection.
- Phishing emails observed delivering a packed, unsigned 32-bit .NET dropper inside an archive attachment, masquerading as a Turkish brick-building game (metadata 'TuglaInsaatci'); observed sample named 'GST Debit Note Apr_26.com'.
- During routine telemetry monitoring, K7 Labs identified a detection on a suspicious file, triggering analysis of the multi-stage steganographic loader campaign.
Sources cited for Multi-Stage Steganographic Loader Campaign Deploying Remcos
- A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally
- Dissecting REMCOS RAT: An in-depth analysis (Part Four)
- Remcos Revisited: Inside the RAT's Evolving Command-and-Control Techniques
- New Remcos RAT Activity Detection: Phishing Campaign Spreading a Novel Fileless Malware Variant
- Process Injection, Technique T1055 — MITRE ATT&CK
- Process Hollowing, Sub-technique T1055.012 — MITRE ATT&CK
- Reflective Code Loading, Technique T1620 — MITRE ATT&CK
- Steganography, Sub-technique T1027.003 — MITRE ATT&CK
Threats related to Multi-Stage Steganographic Loader Campaign Deploying Remcos
- Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution
- Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign
- DNS Pivoting Reveals Shared Infrastructure Across LokiBot, Bagle, Xworm, and Remcos Campaigns
- Operation Turb00: Multi-Stage HijackLoader (IDAT Loader) Campaign Delivers Vidar v2.1 Infostealer and SnappyClient RAT via PNG-IDAT Steganography
- Agent Tesla Multi-Stage Phishing Campaign with Process Hollowing of Aspnet_compiler.exe and SMTP Credential Exfiltration
- NanoCore RAT VBScript Loader Using Chr()/Math/Flow-Control Obfuscation to Evade Static Detection (CyberChef Analysis)
Detection coverage for TL-2026-0896
As of 2026-06-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0896 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0896
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.