Threat reportMalwareTL-2026-0912
Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
Agent Tesla .NET Remote Access Trojan (TL-2026-0912), also tracked as AgentTesla, is a high-severity malware campaign, first published 2026-06-23. It has no confirmed attribution, affects Microsoft Windows, references 2 CVEs (CVE-2017-11882, CVE-2017-8570), maps to 30 MITRE ATT&CK techniques (T1016, T1027, T1033), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 30MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-0912
- Threat ID
- TL-2026-0912
- Also known as
- AgentTesla, Agent Tesla Keylogger, OriginLogger, Negasteal
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- education, government, manufacturing, energy, logistics, financial
- Target regions
- North America, Asia, Europe
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Agent Tesla .NET Remote Access Trojan
Malware and tooling: Agent Tesla, Obfuscar
How Agent Tesla .NET Remote Access Trojan works
Agent Tesla is a .NET-based Remote Access Trojan and information stealer sold as Malware-as-a-Service since 2014. It harvests credentials from 80+ browsers, email, FTP, VPN and Wi-Fi clients, logs keystrokes via SetWindowsHookEx, captures screenshots and webcam video, and exfiltrates stolen data over SMTP, FTP, HTTP, and Telegram. It is delivered through spear-phishing attachments and multi-stage, fileless, process-hollowing infection chains.
Agent Tesla is one of the most prevalent commodity Remote Access Trojans (RATs) in circulation, first observed in late 2014 and continuously developed and resold as Malware-as-a-Service (MaaS) on dark-web forums. Built on the Microsoft .NET framework, it functions primarily as a keylogger and information stealer while retaining full RAT capabilities including remote command execution, file download, screen capture, and webcam access.
Initial access is overwhelmingly achieved through spear-phishing emails carrying malicious attachments. Over its lifetime the delivery vehicle has evolved from macro-enabled Word documents and Microsoft Office equation-editor exploits (CVE-2017-11882, CVE-2017-8570) to OLE objects, batch scripts in archives, and most recently compiled HTML Help (.chm) files and JScript (.jse) loaders packaged inside RAR/GZ archives. A representative 2026 multi-stage chain analyzed by FortiGuard Labs proceeds: email > RAR attachment > JScript (.jse) loader > downloaded PowerShell > in-memory PowerShell > in-memory .NET loader > .NET Agent Tesla payload, with the final payload injected via process hollowing into a legitimate signed .NET binary such as Aspnet_compiler.exe or RegAsm.exe.
The loader chain is heavily obfuscated (Obfuscar, Rijndael/AES-CBC PKCS7 string and payload encryption, Base64-encoded assemblies) and largely fileless — payloads are reflectively loaded into memory rather than written to disk. Anti-analysis routines detect virtualization (VMware, VirtualBox, Hyper-V) and scan for sandbox/EDR DLLs (snxhk.dll, SbieDll.dll, cmdvrt32.dll) before detonation.
Once running, Agent Tesla establishes persistence via Registry Run keys, the Startup folder, Winlogon Shell/Load values, and scheduled tasks (Schtasks.exe /Create). It performs broad system reconnaissance (WMI 'select * from win32_operatingsystem', username, computer name, OS, CPU, RAM, video card), collects Wi-Fi profiles via 'netsh wlan show profile', captures keystrokes through SetWindowsHookEx (logging to %temp%\log.tmp), grabs clipboard contents, takes desktop screenshots, and records webcam video. It steals stored credentials from 80+ applications — Chrome, Firefox, Edge, Brave, Opera, Vivaldi and other Chromium browsers, Outlook, Thunderbird, Mailbird, FileZilla, WinSCP, OpenVPN, NordVPN — by parsing SQLite stores, configuration files, and Registry entries.
Harvested data is archived (3DES/encryption), formatted into CO_/SC_/KL_ prefixed files, and exfiltrated over hardcoded SMTP (TLS, port 587), FTP (STOR with embedded credentials), HTTP, or Telegram Bot API. Telegram has become a dominant C2 channel: Agent Tesla accounted for roughly three-quarters of Telegram-C2 malware samples observed in 2024. Stolen data flows to attacker-controlled mail servers such as mail.taikei-rmc-co.biz, whose bounce traffic betrays large-scale exfiltration operations. Agent Tesla remains a top-10 malware family (Q4 2025, CIS MS-ISAC) and primarily targets the United States, China, Germany, and the global education sector.
MITRE ATT&CK techniques used in TL-2026-0912
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Credential Access
T1056 Input Capture; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Collection
T1113 Screen Capture; T1115 Clipboard Data; T1125 Video Capture; T1185 Browser Session Hijacking; T1560 Archive Collected Data
Initial Access
Affected products and versions in Agent Tesla .NET Remote Access Trojan
Remediation for Agent Tesla .NET Remote Access Trojan
Patches
- Apply Microsoft updates for CVE-2017-11882 (Equation Editor) and CVE-2017-8570 (Composite Moniker)
Immediate actions
- Block known Agent Tesla C2 mail servers and exfiltration domains (e.g., mail.taikei-rmc-co.biz) and file-sharing loader URLs (catbox.moe, archive.org-hosted stagers) at the perimeter
- Block outbound SMTP (port 587/465/25), FTP, and Telegram Bot API (api.telegram.org) traffic from non-mail-server endpoints
- Quarantine inbound emails carrying .chm, .jse, .gz, and RAR attachments containing scripts; strip macro-enabled Office documents
Workarounds
- Restrict non-browser process access to browser credential stores
- Enable AMSI and constrained-language-mode PowerShell to disrupt in-memory .NET loading
Longer-term hardening
- Deploy EDR with behavioral detection for process hollowing into RegAsm.exe/RegSvcs.exe/Aspnet_compiler.exe and SetWindowsHookEx keylogging
- Disable Windows Script Host (wscript/cscript) and CHM (hh.exe) execution where not required
- Enforce Office attack-surface-reduction rules and disable legacy Equation Editor; patch CVE-2017-11882 and CVE-2017-8570
- Deploy phishing-resistant email security with attachment detonation and user awareness training
CVEs associated with Agent Tesla .NET Remote Access Trojan
Weaknesses (CWE) in Agent Tesla .NET Remote Access Trojan
Timeline of Agent Tesla .NET Remote Access Trojan
- Agent Tesla first observed in the wild as a .NET keylogger/information stealer, sold openly as Malware-as-a-Service.
- Campaigns begin weaponizing Microsoft Office Equation Editor vulnerabilities CVE-2017-11882 and CVE-2017-8570 for delivery.
- SentinelLabs documents new evasion tricks, process hollowing into RegAsm.exe, and theft from 80+ applications.
- COVID-19/WHO-themed phishing lures distribute Agent Tesla at scale during the pandemic.
- Delivery shifts toward compiled HTML Help (.chm) files and fileless PowerShell in-memory loaders.
- Agent Tesla accounts for ~77.7% of malware samples using Telegram as a C2/exfiltration channel in 2024.
- FortiGuard Labs details a multi-stage RAR>JSE>PowerShell>.NET chain hollowing Aspnet_compiler.exe, exfiltrating to mail.taikei-rmc-co.biz.
- CIS MS-ISAC ranks Agent Tesla among the Top 10 Malware for Q4 2025.
- Picus Security publishes updated technical analysis of Agent Tesla TTPs, persistence, and exfiltration methods.
Sources cited for Agent Tesla .NET Remote Access Trojan
- Agent Tesla Malware Analysis: How This .NET RAT Steals Your Data
- Agent Tesla, Software S0331 | MITRE ATT&CK
- Agent Tesla | Old RAT Uses New Tricks to Stay on Top
- Inside the Mind of a 'Rat' - Agent Tesla Detection and Analysis
- Unmasking Agent Tesla: A Deep Dive into a Multi-Stage Campaign
- Weaponizing Telegram Bots: How Threat Actors Exfiltrate Credentials
- Top 10 Malware Q4 2025 (CIS MS-ISAC)
- Agent Tesla Malware Analysis, Overview by ANY.RUN
Detection coverage for TL-2026-0912
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0912 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.