Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign
Remcos RAT Delivered via Steganographic Multi-Stage Loader (TL-2026-0911), also tracked as GST Debit Note Remcos Campaign, is a high-severity malware campaign, first published 2026-06-23. It has no confirmed attribution, affects Microsoft Windows, maps to 24 MITRE ATT&CK techniques (T1010, T1027, T1036), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-0911
- Threat ID
- TL-2026-0911
- Also known as
- GST Debit Note Remcos Campaign, TuglaInsaatci Loader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-23
- Last reviewed
- 2026-06-23
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- financial, government, small-and-medium-business, taxpayers
- Target regions
- India, South Asia
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Remcos RAT Delivered via Steganographic Multi-Stage Loader
Malware and tooling: 404 Keylogger, Agent Tesla, DarkCloud, Formbook, MASS Logger, Phantom Stealer, RedLine Stealer - S1240, Remcos, XWorm
An active phishing campaign targeting Indian users distributes a malicious archive whose payload, 'GST Debit Note Apr_26.com', is a 32-bit .NET dropper masquerading as a Turkish-language brick-building game. It launches a fileless, steganographic multi-stage loader chain (Optimax.dll then System Optimizer Ultimate.dll, hidden inside serialized .NET Bitmap resources) that deploys Remcos RAT for remote control, browser credential theft, audio/webcam surveillance, and keylogging. Reported by K7 Security Labs and tracked as part of a loader-as-a-service operation.
How Remcos RAT Delivered via Steganographic Multi-Stage Loader works
K7 Security Labs documented an active phishing campaign that weaponizes Indian financial-system lures (GST, NEFT, RTGS, IMPS) to deliver Remcos RAT to victims in India. The infection begins with a phishing email carrying an archive attachment (MD5 C2E25ABA8E2AD4CAFDD6C633B8CA0906). On extraction it drops 'GST Debit Note Apr_26.com' (MD5 897ABF678EDAD72998554EC18675092F), an unsigned, packed 32-bit .NET executable that masquerades as a brick-building game and carries Turkish-language artifacts (metadata string 'TuglaInsaatci'), displaying a decoy game UI to reduce suspicion while executing malicious code in the background.
The loader operates almost entirely in memory. It conceals next-stage payloads using steganography: resource section SR1 holds a serialized .NET Bitmap object that is actually a container for the hidden second-stage DLL, Optimax.dll (MD5 AFE085B7324D72673EEF749FF5F21A49). The loader extracts the embedded bytes and uses AppDomain.Load on a byte array (this.pf.ToArray<byte>()) to load assemblies reflectively without writing them to disk. Optimax.dll in turn unpacks the third-stage loader, System Optimizer Ultimate.dll (MD5 F3626A38FCF488C9EED54BEB8C7C116F), which finally deploys the Remcos RAT payload (MD5 4924369C0BDAF73B21EB992EB9DB4DEA). The full chain is: archive -> .com dropper -> Optimax.dll -> System Optimizer Ultimate.dll -> Remcos RAT.
Before detonation the malware runs anti-analysis checks, looking for the Sandboxie module sbiedll.dll and VirtualBox artifacts via the registry marker HARDWARE\ACPI\DSDT\VBOX_. It escalates privileges and bypasses User Account Control by abusing eventvwr.exe (the classic Event Viewer / fodhelper-style auto-elevation technique), then performs process hollowing to masquerade as the victim's default web browser process. Persistence is established by dropping a randomized, superhidden self-copy into %AppData%\Roaming and registering a Run key for auto-launch at login, with additional Winlogon (winlogon.exe / Userinit) modifications.
The deployed Remcos RAT confirms infection with the mutex 'Remcos_Mutex_Inj' and beacons to attacker C2 over non-standard TCP ports: primary 62.102.148.212:37393, plus 217.138.252.123:42830 and 146.70.244.90:37393. Capabilities include window-title monitoring, idle-time tracking, audio recording, webcam capture, keystroke logging, and credential/cookie harvesting from Chrome and Firefox, with stolen data written to 'logs.dat' and exfiltrated over the C2 channel. K7 assesses the distribution infrastructure as a loader-as-a-service operation: the same network is rented to deliver other commodity families including Agent Tesla, MassLogger, Phantom Stealer, RedLine Stealer, Formbook, Snake keylogger, DarkCloud, and XWorm. The campaign is currently unattributed to a specific actor.
MITRE ATT&CK techniques used in TL-2026-0911
Discovery
T1010 Application Window Discovery; T1082 System Information Discovery; T1124 System Time Discovery; T1497 Virtualization/Sandbox Evasion
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Privilege Escalation
T1055 Process Injection; T1548 Abuse Elevation Control Mechanism
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Collection
T1056 Input Capture; T1123 Audio Capture; T1125 Video Capture
Command and Control
T1095 Non-Application Layer Protocol; T1571 Non-Standard Port
Execution
T1106 Native API; T1204 User Execution
Persistence
T1547 Boot or Logon Autostart Execution
Initial Access
Resource Development
Affected products and versions in Remcos RAT Delivered via Steganographic Multi-Stage Loader
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows endpoints running .NET Framework - Google — Chrome
Vulnerable versions: Credential/cookie store targeted for theft - Mozilla — Firefox
Vulnerable versions: Credential store targeted for theft
Remediation for Remcos RAT Delivered via Steganographic Multi-Stage Loader
Immediate actions
- Block C2 IPs 62.102.148.212, 217.138.252.123, and 146.70.244.90 at the network perimeter
- Block/quarantine emails carrying archive attachments with double-extension or .com executables themed around GST/NEFT/RTGS/IMPS
- Hunt for the mutex 'Remcos_Mutex_Inj' and for randomized superhidden executables in %AppData%\Roaming
- Hunt for the listed file MD5 hashes across the estate and isolate matching hosts
Workarounds
- Block the .com file extension at the mail gateway
- Configure Registry hardening / UAC to 'Always Notify' to reduce eventvwr.exe auto-elevation abuse
- Restrict outbound traffic to non-standard high TCP ports from user workstations
Longer-term hardening
- Deploy EDR with behavioral detection for process hollowing, reflective .NET assembly loading, and UAC bypass via eventvwr.exe
- Enforce attachment sandboxing and detonation for inbound archives
- Disable execution of .com/.exe files from archive and user-writable paths via application control (WDAC/AppLocker)
- Enable browser credential-store protection and phishing-resistant MFA to limit value of stolen credentials
Timeline of Remcos RAT Delivered via Steganographic Multi-Stage Loader
- Remcos ('Remote Control & Surveillance') first surfaces as a commercial RAT marketed by Breaking Security, later widely abused as commodity malware in phishing campaigns - establishing the payload family used in this campaign.
- Phishing emails carrying the malicious archive attachment (MD5 C2E25ABA8E2AD4CAFDD6C633B8CA0906) circulate to Indian targets using GST/NEFT/RTGS/IMPS financial-system lures.
- Lure themed as an April 2026 GST debit note ('GST Debit Note Apr_26.com'), indicating campaign tooling dated to or around April 2026.
- Campaign assessed as actively distributing Remcos RAT and additional infostealers via the loader-as-a-service network at time of reporting; remains unattributed.
- K7 assesses the delivery network as a loader-as-a-service operation also distributing Agent Tesla, MassLogger, Phantom Stealer, RedLine, Formbook, Snake Keylogger, DarkCloud, and XWorm.
- CyberPress publishes parallel coverage describing the steganographic loader delivering Remcos RAT via phishing attachments.
- Cyber Security News publishes coverage of the 'GST Debit Note' Remcos RAT campaign with C2 and hash IOCs.
- GBHackers (Mayura Kathir) publishes a technical writeup of the steganographic loader chain and IOCs based on the K7 Labs report.
- K7 Security Labs publishes analysis of the multi-stage steganographic Remcos loader campaign targeting Indian users, documenting the .com dropper, Optimax.dll/System Optimizer Ultimate.dll loader chain, and C2 IOCs.
- Threat ingested and analyzed by Threadlinqs Intelligence (TL-2026-0911) with full IOC, MITRE, and detection scoping.
Sources cited for Remcos RAT Delivered via Steganographic Multi-Stage Loader
- Malicious GST Debit Note Attachment Deploys Remcos RAT
- Multi-Stage Steganographic Loader Deploys Remcos RAT and Multiple Infostealers Globally
- Hackers Use Steganographic Loader to Deliver Remcos RAT via Phishing Attachments
- K7 Labs: multi-stage fileless Remcos loader campaign using steganography and in-memory DLL loading
- MITRE ATT&CK: Process Hollowing (T1055.012)
- MITRE ATT&CK: Abuse Elevation Control Mechanism - Bypass User Account Control (T1548.002)
- MITRE ATT&CK: Obfuscated Files or Information - Steganography (T1027.003)
Threats related to Remcos RAT Delivered via Steganographic Multi-Stage Loader
- Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution
- Multi-Stage Steganographic Loader Campaign Deploying Remcos RAT and Diverse Stealer Payloads (K7 Labs, June 2026)
- Agent Tesla Multi-Stage Phishing Campaign with Process Hollowing of Aspnet_compiler.exe and SMTP Credential Exfiltration
- NanoCore RAT VBScript Loader Using Chr()/Math/Flow-Control Obfuscation to Evade Static Detection (CyberChef Analysis)
- MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials
- MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass and Multi-Browser Session Hijacking
Detection coverage for TL-2026-0911
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0911 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0911
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.