Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign

Key facts for GST Debit Note Remcos loader

Detection coverage for GST Debit Note Remcos loader

As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0911 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GST Debit Note .COM Dropper Execution & Reflective In-Memory .NET Load — Exploitation

Detects execution of the campaign's initial-access dropper: a 32-bit .NET .com executable launched from a user-writable / archive-extraction path (e.g. 'GST Debit Note Apr_26.com'), correlated with reflective in-memory assembly loading where clr.dll/mscoree.dll is loaded but the staged DLL (Optimax.dll / System Optimizer Ultimate.dll) never appears as a disk image-load. This is the steganographic loader's signature: AppDomain.Load(byte[]) of a stage hidden in a .NET Bitmap resource, with no corresponding file on disk.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1027.003, T1620, T1140
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval img=lower(Image)
```Initial-access dropper: .com (or double-extension) executable from a user-writable / archive-extraction path```
| where (like(img,"%.com") OR match(img,"\.(com|exe)$")) AND (match(img,"\\\\appdata\\\\") OR match(img,"\\\\temp\\\\") OR match(img,"\\\\downloads\\\\") OR like(img,"%gst debit note%") OR like(img,"%tuglainsaatci%"))
| eval is_dotnet=if(match(lower(Description),"\.net|microsoft\.net") OR like(lower(OriginalFileName),"%.com"),1,0)
| table _time host User Image OriginalFileName CommandLine ParentImage Hashes ProcessGuid
| join type=left ProcessGuid
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 (ImageLoaded="*\\clr.dll" OR ImageLoaded="*\\mscoree.dll" OR ImageLoaded="*\\mscorlib*")
    | stats values(ImageLoaded) as clr_modules by ProcessGuid ]
| where isnotnull(clr_modules)
```Reflective load tell: CLR present but staged loader DLL never image-loaded from disk```
| search NOT [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 (ImageLoaded="*\\Optimax.dll" OR ImageLoaded="*System Optimizer Ultimate.dll") | fields ProcessGuid ]
| table _time host User Image CommandLine ParentImage clr_modules Hashes

Microsoft KQL

let window = 1h;
let dropper = DeviceProcessEvents
| where Timestamp > ago(window)
| where FolderPath has_any (@"\AppData\", @"\Temp\", @"\Downloads\") or FileName endswith ".com" or FileName has "GST Debit Note" or ProcessVersionInfoOriginalFileName has "Tugla"
| where FileName endswith ".com" or FileName endswith ".exe"
| project Timestamp, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256, ProcessId;
let clr = DeviceImageLoadEvents
| where Timestamp > ago(window)
| where FileName in~ ("clr.dll","mscoree.dll","clrjit.dll")
| distinct DeviceId, ProcessId;
let stagedLoad = DeviceImageLoadEvents
| where Timestamp > ago(window)
| where FileName in~ ("Optimax.dll","System Optimizer Ultimate.dll")
| distinct DeviceId, ProcessId;
dropper
| join kind=inner clr on DeviceId, ProcessId
| join kind=leftanti stagedLoad on DeviceId, ProcessId
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256

Sigma

title: GST Debit Note .COM .NET Dropper Execution (Steganographic Remcos Loader)
id: 7b2f1c9a-0d44-4e21-9c3a-1a2b3c4d5e61
status: experimental
description: Detects execution of the TL-2026-0911 initial-access dropper - a 32-bit .NET .com executable themed on Indian GST/financial lures, carrying Turkish 'TuglaInsaatci' artifacts, launched from a user-writable or archive-extraction path.
references:
    - https://cybersecuritynews.com/malicious-gst-debit-note-attachment-deploys-remcos-rat/
    - https://gbhackers.com/steganographic-loader-deploys-remcos-rat/
    - https://attack.mitre.org/techniques/T1204/002/
    - https://attack.mitre.org/techniques/T1620/
author: AII-Detector - ThreadLinqs Intelligence
date: 2026/06/23
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1027.003
    - attack.t1620
    - attack.tool.remcos
logsource:
    product: windows
    category: process_creation
detection:
    selection_ext:
        Image|endswith: '.com'
    selection_path:
        Image|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Downloads\'
    selection_name:
        - Image|contains: 'GST Debit Note'
        - OriginalFileName|contains: 'Tugla'
        - Product|contains: 'Tugla'
    condition: selection_ext and (selection_path or selection_name)
falsepositives:
    - Legitimate .com utilities (rare) executed from temp paths by administrators
level: high

Known false positives:

• Legitimate .com console utilities run from temp/download paths by administrators
• Self-extracting installers that reflectively load .NET assemblies

Tuning notes: Whitelist known-good signed .com utilities and approved installer hashes. If image-load (EventCode 7 / DeviceImageLoadEvents) volume is heavy, scope the CLR correlation to processes whose parent is an archive tool (winrar/7z/explorer). Add the campaign MD5s (897ABF67..., AFE085B7..., F3626A38...) as a high-fidelity boost.

• 🔒 Steganographic .NET-Bitmap Stage Extraction & Reflective In-Memory Load — Exploitation · unlock with TL Creds
• 🔒 Anti-Analysis VM/Sandbox Checks + AppData Persistence Drop — Post-Exploitation · unlock with TL Creds
• 🔒 Browser Credential/Cookie Theft, [indicator] Staging & Surveillance Capture — C2 / Collection · unlock with TL Creds
• 🔒 Steganographic .NET-Bitmap Resource Container — Exploitation Artifact · unlock with TL Creds
• 🔒 [indicator] Auto-Elevation Child Process Following ms-settings Hijack — Privilege Escalation · unlock with TL Creds
• 🔒 Remcos Infection Mutex & Process Hollowing into Default Browser — C2 / Lateral · unlock with TL Creds
• 🔒 Superhidden AppData Run-Key Persistence with eventvwr/fodhelper UAC Bypass — Post-Exploitation · unlock with TL Creds
• 🔒 Remcos C2 Beacon — Non-Standard High-Port TCP, Browser Process Hollowing & Infection Mutex — C2 / Lateral · unlock with TL Creds

Indicators of compromise for GST Debit Note Remcos loader

As of 2026-06-23, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-0911.

Sample indicators (3 of 31)

• IP address: 62.102.148[.]212
• File hash: C2E25ABA8E2AD4CAFDD6C633B8CA0906
• IP address: 217.138.252[.]123

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

Community OSINT corroboration for GST Debit Note Remcos loader

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How GST Debit Note Remcos loader works

Reported by K7 Security Labs and tracked as part of a loader-as-a-service operation.

K7 Security Labs documented an active phishing campaign that weaponizes Indian financial-system lures (GST, NEFT, RTGS, IMPS) to deliver Remcos RAT to victims in India. The infection begins with a phishing email carrying an archive attachment (MD5 C2E25ABA8E2AD4CAFDD6C633B8CA0906). On extraction it drops 'GST Debit Note Apr_26.com' (MD5 897ABF678EDAD72998554EC18675092F), an unsigned, packed 32-bit .NET executable that masquerades as a brick-building game and carries Turkish-language artifacts (metadata string 'TuglaInsaatci'), displaying a decoy game UI to reduce suspicion while executing malicious code in the background.

The loader operates almost entirely in memory. It conceals next-stage payloads using steganography: resource section SR1 holds a serialized .NET Bitmap object that is actually a container for the hidden second-stage DLL, Optimax.dll (MD5 AFE085B7324D72673EEF749FF5F21A49). The loader extracts the embedded bytes and uses AppDomain.Load on a byte array (this.pf.ToArray<byte>()) to load assemblies reflectively without writing them to disk. Optimax.dll in turn unpacks the third-stage loader, System Optimizer Ultimate.dll (MD5 F3626A38FCF488C9EED54BEB8C7C116F), which finally deploys the Remcos RAT payload (MD5 4924369C0BDAF73B21EB992EB9DB4DEA). The full chain is: archive -> .com dropper -> Optimax.dll -> System Optimizer Ultimate.dll -> Remcos RAT.

Before detonation the malware runs anti-analysis checks, looking for the Sandboxie module sbiedll.dll and VirtualBox artifacts via the registry marker HARDWARE\ACPI\DSDT\VBOX_. It escalates privileges and bypasses User Account Control by abusing eventvwr.exe (the classic Event Viewer / fodhelper-style auto-elevation technique), then performs process hollowing to masquerade as the victim's default web browser process. Persistence is established by dropping a randomized, superhidden self-copy into %AppData%\Roaming and registering a Run key for auto-launch at login, with additional Winlogon (winlogon.exe / Userinit) modifications.

The deployed Remcos RAT confirms infection with the mutex 'Remcos_Mutex_Inj' and beacons to attacker C2 over non-standard TCP ports: primary 62.102.148.212:37393, plus 217.138.252.123:42830 and 146.70.244.90:37393. Capabilities include window-title monitoring, idle-time tracking, audio recording, webcam capture, keystroke logging, and credential/cookie harvesting from Chrome and Firefox, with stolen data written to 'logs.dat' and exfiltrated over the C2 channel. K7 assesses the distribution infrastructure as a loader-as-a-service operation: the same network is rented to deliver other commodity families including Agent Tesla, MassLogger, Phantom Stealer, RedLine Stealer, Formbook, Snake keylogger, DarkCloud, and XWorm. The campaign is currently unattributed to a specific actor.

MITRE ATT&CK techniques by tactic:

Discovery

T1010 Application Window Discovery; T1082 System Information Discovery; T1124 System Time Discovery; T1497 Virtualization/Sandbox Evasion

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Privilege Escalation

T1055 Process Injection; T1548 Abuse Elevation Control Mechanism

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Collection

T1056 Input Capture; T1123 Audio Capture; T1125 Video Capture

Command and Control

T1095 Non-Application Layer Protocol; T1571 Non-Standard Port

Execution

T1106 Native API; T1204 User Execution

Persistence

T1547 Boot or Logon Autostart Execution

Initial Access

T1566 Phishing

Resource Development

T1608 Stage Capabilities

Remediation for GST Debit Note Remcos loader

Immediate actions

• Block C2 IPs 62.102.148.212, 217.138.252.123, and 146.70.244.90 at the network perimeter
• Block/quarantine emails carrying archive attachments with double-extension or .com executables themed around GST/NEFT/RTGS/IMPS
• Hunt for the mutex 'Remcos_Mutex_Inj' and for randomized superhidden executables in %AppData%\Roaming
• Hunt for the listed file MD5 hashes across the estate and isolate matching hosts

Workarounds

• Block the .com file extension at the mail gateway
• Configure Registry hardening / UAC to 'Always Notify' to reduce eventvwr.exe auto-elevation abuse
• Restrict outbound traffic to non-standard high TCP ports from user workstations

Longer-term hardening

• Deploy EDR with behavioral detection for process hollowing, reflective .NET assembly loading, and UAC bypass via eventvwr.exe
• Enforce attachment sandboxing and detonation for inbound archives
• Disable execution of .com/.exe files from archive and user-writable paths via application control (WDAC/AppLocker)
• Enable browser credential-store protection and phishing-resistant MFA to limit value of stolen credentials

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 10; Windows 11; Windows endpoints running .NET Framework
• Google — Chrome
  Vulnerable versions: Credential/cookie store targeted for theft
• Mozilla — Firefox
  Vulnerable versions: Credential store targeted for theft

Timeline of GST Debit Note Remcos loader

• 2016-01-01 locked-ioc-29 ('Remote Control & Surveillance') first surfaces as a commercial RAT marketed by Breaking Security, later widely abused as commodity malware in phishing campaigns - establishing the payload family used in this campaign.
• 2026-04-01 Phishing emails carrying the malicious archive attachment (MD5 locked-ioc-4) circulate to Indian targets using GST/NEFT/RTGS/IMPS financial-system lures.
• 2026-04-01 Lure themed as an April 2026 GST debit note ('locked-ioc-10'), indicating campaign tooling dated to or around April 2026.
• 2026-06-22 Campaign assessed as actively distributing locked-ioc-29 RAT and additional infostealers via the loader-as-a-service network at time of reporting; remains unattributed.
• 2026-06-22 K7 assesses the delivery network as a loader-as-a-service operation also distributing locked-ioc-24, locked-ioc-25, locked-ioc-18, RedLine, locked-ioc-28, locked-ioc-17, locked-ioc-26, and locked-ioc-30.
• 2026-06-22 CyberPress publishes parallel coverage describing the steganographic loader delivering locked-ioc-29 RAT via phishing attachments.
• 2026-06-22 Cyber Security News publishes coverage of the 'GST Debit Note' locked-ioc-29 RAT campaign with C2 and hash IOCs.
• 2026-06-22 GBHackers (Mayura Kathir) publishes a technical writeup of the steganographic loader chain and IOCs based on the K7 Labs report.
• 2026-06-22 K7 Security Labs publishes analysis of the multi-stage steganographic locked-ioc-29 loader campaign targeting Indian users, documenting the .com dropper, locked-ioc-22/locked-ioc-9 loader chain, and C2 IOCs.
• 2026-06-23 Threat ingested and analyzed by Threadlinqs Intelligence (TL-2026-0911) with full IOC, MITRE, and detection scoping.

Sources cited for GST Debit Note Remcos loader

• Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally gbhackers.com · Research · 2026-06-22
• MITRE ATT&CK: Process Hollowing (T1055.012) MITRE · Research · 2026-06-22
• MITRE ATT&CK: Abuse Elevation Control Mechanism - Bypass User Account Control (T1548.002) MITRE · Research · 2026-06-22
• MITRE ATT&CK: Obfuscated Files or Information - Steganography (T1027.003) MITRE · Research · 2026-06-22
• K7 Labs: multi-stage fileless Remcos loader campaign using steganography and in-memory DLL loading malwaretips.com · Blog · 2026-06-22
• Malicious GST Debit Note Attachment Deploys Remcos RAT cybersecuritynews.com · News · 2026-06-22
• Hackers Use Steganographic Loader to Deliver Remcos RAT via Phishing Attachments cyberpress.org · News · 2026-06-22

Threats related to GST Debit Note Remcos loader

• Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution
• Multi-Stage Steganographic Loader Campaign Deploying Remcos RAT and Diverse Stealer Payloads (K7 Labs, June 2026)
• Agent Tesla Multi-Stage Phishing Campaign with Process Hollowing of Aspnet_compiler.exe and SMTP Credential Exfiltration
• NanoCore RAT VBScript Loader Using Chr()/Math/Flow-Control Obfuscation to Evade Static Detection (CyberChef Analysis)
• MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials

Related coverage of this activity

• TonRAT Booking.com hotel phishing
• MedusaHVNC AMSI/ETW hidden desktop
• SystemBC ransomware Tor persistence
• TTF Trap font-file loader
• Remcos payment lure OLE2Link

Previous and next in malware

• ClockLauncher PHP Backdoor: php-win.exe LOLBin Abuse for Invisible Execution, LocalSystem Persistence, and EDR-Evasive RMM Deployment Previous report
• Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations Next report