# Multi-Stage Steganographic Loader Campaign Deploying Remcos RAT and Diverse Stealer Payloads (K7 Labs, June 2026)

> An active, globally-distributed phishing campaign uses a multi-stage .NET loader chain that conceals next-stage payloads inside a serialized .NET Bitmap object embedded in a resource section, executing each stage in memory to avoid disk artifacts. The chain delivers Remcos RAT via two .NET loaders (Optimax.dll then System Optimizer Ultimate.dll); the broader operation also distributes Agent Tesla, MassLogger, Phantom Stealer, Dark Cloud, RedLine Stealer, Snake Keylogger, Formbook, and XWorm.

- **Published:** 2026-06-21T00:00:00Z
- **Last reviewed:** 2026-06-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0896
- **ID:** TL-2026-0896
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

K7 Labs reported (22 June 2026) an active multi-stage steganographic loader campaign distributing a diverse set of RAT and infostealer payloads worldwide, with India-focused financial lures observed prominently.

Initial access is via phishing email carrying an archive attachment. The Stage 1 dropper is a 32-bit, packed, unsigned .NET executable masquerading as a brick-building game carrying Turkish-language artifacts (metadata string 'TuglaInsaatci', Turkish for 'brick-builder'); an observed sample was named 'GST Debit Note Apr_26.com'. The dropper retrieves a hidden next stage from its resource sections: the payload is steganographically concealed inside a serialized .NET Bitmap object stored in a resource named 'SR1', defeating naive static inspection.

The extracted Stage 2 loader, Optimax.dll (32-bit .NET), dynamically loads a subsequent .NET assembly directly from an in-memory byte array using AppDomain.Load (reflective / in-memory assembly loading), leaving no second-stage file on disk. Stage 3, 'System Optimizer Ultimate.dll', delivers the final payload — Remcos RAT — in memory. Remcos is injected via process hollowing into the system's default browser process. The fileless, staged design (steganographic resource container + reflective assembly loading + process hollowing) is engineered specifically to evade disk-based and signature detection.

The deployed Remcos RAT establishes persistence through a Run registry key, self-copies to %AppData%\Roaming under a randomized name with the super-hidden attribute, and deploys an obfuscated PowerShell (.ps1) script; the report also notes winlogon.exe execution and userinit integration. It bypasses UAC by abusing eventviewer.exe, creates the mutex 'Remcos_Mutex_Inj', and performs anti-analysis checks for the Sandboxie module sbiedll.dll and for VirtualBox via the registry path hardware\acpi\dsdt\vbox_. Remcos provides keylogging, screen capture, audio capture, webcam/video capture, peripheral discovery, and browser credential theft; collected data is written to 'logs.dat' and exfiltrated to the C2. Observed Remcos C2 endpoints are 62.102.148.212:37393 (primary), 217.138.252.123:42830, and 146.70.244.90:37393.

The campaign is not tied to a CVE; it relies on social engineering and loader tradecraft rather than software vulnerability exploitation.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1055.012 Process Hollowing
- T1548.002 Bypass User Account Control
- T1564.001 Hidden Files and Directories
- T1112 Modify Registry
- T1497.001 System Checks
- T1547.001 Registry Run Keys / Startup Folder
- T1547.004 Winlogon Helper DLL
- T1548.002 Bypass User Account Control
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1120 Peripheral Device Discovery
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Sources

- [A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally](https://labs.k7computing.com/index.php/a-multi-stage-steganographic-loader-campaign-deploying-diverse-payloads-globally/)
- [Dissecting REMCOS RAT: An in-depth analysis (Part Four)](https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four)
- [Remcos Revisited: Inside the RAT's Evolving Command-and-Control Techniques](https://www.pointwild.com/threat-intelligence/remcos-revisited-inside-the-rats-evolving-command-and-control-techniques/)
- [New Remcos RAT Activity Detection: Phishing Campaign Spreading a Novel Fileless Malware Variant](https://socprime.com/blog/new-remcos-rat-activity-detection/)
- [Process Injection, Technique T1055 — MITRE ATT&CK](https://attack.mitre.org/techniques/T1055/)
- [Process Hollowing, Sub-technique T1055.012 — MITRE ATT&CK](https://attack.mitre.org/techniques/T1055/012/)
- [Reflective Code Loading, Technique T1620 — MITRE ATT&CK](https://attack.mitre.org/techniques/T1620/)
- [Steganography, Sub-technique T1027.003 — MITRE ATT&CK](https://attack.mitre.org/techniques/T1027/003/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0896