Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations

Remcos RAT: Technical Analysis of Windows Remote Access (TL-2026-1133), also tracked as RemcosRAT, is a high-severity malware campaign, first published 2026-07-05. It has no confirmed attribution, affects Microsoft Windows (desktop and server), maps to 39 MITRE ATT&CK techniques (T1027, T1027.002, T1036.005), and is covered by 9 detection rules and 48 indicators of compromise.

Key facts for TL-2026-1133

Threat ID
TL-2026-1133
Also known as
RemcosRAT, Remvio, Socmer
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-05
Last reviewed
2026-07-05
Attribution confidence
MEDIUM
Motivation
ESPIONAGE
Target sectors
government administration, state-local-tribal-territorial-government, critical-infrastructure, technology, finance, education
Target regions
North America, Europe, ukraine, Global
Detection rules
9
Indicators of compromise
48

Malware and tooling in Remcos RAT: Technical Analysis of Windows Remote Access

Malware and tooling: Remcos, SHADOW#REACTOR, ZPHP / SmartApeSG loader campaign, Nirsoft utilities, Remcos Pro v4.9.2

Remcos (Remote Control and Surveillance) is a Windows remote access trojan originally marketed as legitimate remote administration software by Breaking Security in 2016 that has become one of the most prevalent commodity RATs in the wild. It grants an operator near-complete control over an infected machine via keylogging, screenshot/audio/webcam capture, credential and browser data theft, command execution, registry editing, and file management, using process injection, a COM-based UAC bypass, and multi-layered registry/watchdog persistence to evade defenses and survive reboot.

How Remcos RAT: Technical Analysis of Windows Remote Access works

Remcos (Remote Control and Surveillance) is a Windows remote access trojan first released in 2016 by the vendor Breaking Security, which continues to market it commercially as a legitimate remote-administration and monitoring tool. Despite this commercial packaging, Remcos has become one of the most prevalent commodity RATs deployed in criminal and espionage operations, tracked by MITRE ATT&CK as Software S0332 since 29 January 2019 and linked to operators ranging from financially motivated crimeware loader ecosystems (SmartApeSG/ZPHP) to the Gorgon Group and Ukraine-focused UAC-0050, with reported historical use by APT33.

Delivery is opportunistic and multi-vector. One documented chain begins with phishing emails carrying a ZIP archive ('MV MERKET COOPER SPECIFICATION.zip') containing an obfuscated JScript loader that contacts almacensantangel.com to retrieve a PowerShell stage (ENCRYPT.Ps1). The PowerShell performs rotating-XOR decryption via a '$masterdecoder' routine to reconstruct a .NET assembly (ALTERNATE.dll) that is loaded reflectively in memory (no disk writes), which in turn injects a final payload (Cqeqpvzeia.exe) into aspnet_compiler.exe for C2 communications. A separate, large-scale chain — tracked as ZPHP/SmartApeSG and observed impacting U.S. State, Local, Tribal, and Territorial (SLTT) government organizations — compromises legitimate websites to serve a fake CAPTCHA page using the ClickFix social-engineering technique: the page silently copies a malicious command to the clipboard and instructs the victim to paste and execute it via the Windows Run dialog, which drops an HTA (%AppData%\post.hta), executed by mshta.exe, that downloads compressed payloads and DLL-side-loads Remcos alongside NetSupport RAT, StealC, and Sectop RAT (ArechClient2) — up to four RAT/stealer families delivered to a single host in one session.

Once running, Remcos stores its configuration RC4-encrypted inside a PE resource named 'SETTINGS' (first byte = key length, followed by the RC4 key and then the ciphertext), with individual configuration fields separated by the delimiter \x7c\x1f\x1e\x1e\x7c. Its C2 protocol is framed with a 0xFF0424 magic header, a 4-byte length field, a 4-byte command ID, and data fields separated by \x1e\x1e\x1f|, transmitted over HTTP or raw TCP — frequently to dynamic-DNS-registered domains (DuckDNS, No-IP/hopto.org, ddns.net) or hardcoded IP:port pairs on both standard and non-standard ports (80, 443, 465, 2404, 2667, 7056, 7902, 8080, 8087).

For privilege escalation, Remcos performs a COM-based UAC bypass: it edits its own Process Environment Block to masquerade as explorer.exe, then calls CoGetObject with an 'Elevation:Administrator!new:' moniker against the CMSTPLUA CLSID to obtain the ICMLuaUtil interface and invoke its ShellExec() method for an elevated relaunch, and can additionally disable UAC outright via 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f'. Persistence is layered: registry Run keys (HKCU and HKLM …\CurrentVersion\Run, and …\Policies\Explorer\Run) plus a watchdog process — masquerading as svchost.exe, rmclient.exe, or fsutil.exe — that rewrites the implant's 'EXEpath' registry value and restarts the main process if terminated. Process injection targets trusted hosts (svchost.exe, iexplore.exe) or abused LOLBins (aspnet_compiler.exe) via remote process mapping and process hollowing.

Surveillance capability is extensive and has recently expanded toward near-real-time exfiltration: low-level keyboard hooking (SetWindowsHookExA with WH_KEYBOARD_LL) for keylogging, BitBlt/CreateCompatibleBitmap screenshots (time_YYYYMMDD_HHMMSS.jpg), Windows Wave-API audio recording, and a runtime-injected, disk-never-touching webcam DLL (OpenCamera/CloseCamera/GetFrame/FreeFrame) — with variants observed in early 2026 (tracked in reporting as part of the 'SHADOW#REACTOR' evolution) streaming webcam footage and transmitting keystrokes instantly rather than batching them, reducing forensic residue. Credential-access modules dump browser-stored logins and cookies (Internet Explorer, Firefox, Chrome) via injected helper utilities invoked with a '/sext' parameter and Nirsoft-based history/password extractors, and can optionally wipe that same browser data (deleting container.dat cookie stores) as an anti-forensic 'browser cleaning' routine executed on startup. Discovery functions include installed-application enumeration (via the Software\Microsoft\Windows\CurrentVersion\Uninstall registry hive) and IP-geolocation lookups against the geoplugin.net web service. Remcos additionally exposes live remote shell, file management, registry editing, and a SOCKS5 proxy module for operator network pivoting, all logged locally (observed at C:\ProgramData\remcos\logs.dat) before transmission to the operator's C2 panel.

MITRE ATT&CK techniques used in TL-2026-1133

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1055.012 Process Hollowing; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Privilege Escalation

T1055 Process Injection; T1548.002 Bypass User Account Control

Collection

T1056.001 Keylogging; T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1518 Software Discovery; T1614 System Location Discovery

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Initial Access

T1189 Drive-by Compromise; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

execution

T1204.004 Malicious Copy and Paste

stealth

T1218.003 CMSTP; T1218.005 Mshta

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Persistence

T1547.001 Registry Run Keys / Startup Folder

Resource Development

T1583.001 Domains

Affected products and versions in Remcos RAT: Technical Analysis of Windows Remote Access

  • Microsoft — Windows (desktop and server)
    Vulnerable versions: Windows 7; Windows 8.1; Windows 10; Windows 11; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022
  • Breaking Security — Remcos (commercial RAT, including Pro build v4.9.2 observed in the wild)
    Vulnerable versions: All commercially distributed builds have been observed abused by threat actors

Remediation for Remcos RAT: Technical Analysis of Windows Remote Access

Patches

  • No vendor patch applies — Remcos is a commercially sold remote-administration tool abused by threat actors rather than a software vulnerability; mitigation is detection- and behavior-based

Immediate actions

  • Block confirmed C2 IPs and domains (see IOCs) at perimeter firewall, proxy, and DNS resolvers
  • Hunt for and quarantine hosts exhibiting the 'EXEpath' registry modification or presence of C:\ProgramData\remcos\logs.dat
  • Reset and rotate credentials on any host where browser credential/cookie theft indicators are found
  • Hunt for RC4-encrypted PE resources named 'SETTINGS' and the 0xFF0424 C2 magic header in network captures
  • Block or alert on execution of mshta.exe with command-line arguments referencing user-writable paths (%AppData%, %Temp%)

Workarounds

  • Disable Windows Script Host (wscript.exe/cscript.exe) execution via Group Policy where not operationally required
  • Restrict PowerShell execution policy and enable Constrained Language Mode / AMSI logging on endpoints
  • Set EnableLUA registry protections to alert-on-write via a security baseline (GPO) to catch UAC-disable attempts

Longer-term hardening

  • Deploy EDR with behavioral detection for process injection (remote mapping/hollowing) and the ICMLuaUtil/CMSTPLUA COM-based UAC bypass
  • Conduct user security-awareness training specifically covering ClickFix/fake-CAPTCHA social engineering and clipboard-paste-into-Run-dialog lures
  • Enforce email gateway filtering/sandboxing for ZIP, JS, and HTA attachments
  • Monitor and alert on egress connections to Dynamic DNS providers (DuckDNS, No-IP/hopto.org, ddns.net) and non-standard destination ports
  • Apply Windows Script Host and mshta.exe restriction policies (WDAC/AppLocker) on endpoints that do not require them

Timeline of Remcos RAT: Technical Analysis of Windows Remote Access

  • Remcos (Remote Control and Surveillance) is first released and marketed by Breaking Security as ostensibly legitimate remote-administration/surveillance software.
  • MITRE ATT&CK formally adds Remcos as tracked Software S0332.
  • CERT-UA attributes a phishing campaign delivering Remcos RAT to the threat actor subsequently tracked as UAC-0050, targeting Ukrainian government and security entities.
  • UAC-0050 reported using new phishing tactics, including unnamed pipes for interprocess communication to decrypt and launch Remcos RAT v4.9.2 Pro.
  • Elastic Security Labs publishes 'Dissecting REMCOS RAT' Part Four, detailing C2 command structure, process-injection targets, UAC bypass, and sample IOCs.
  • Reporting describes a Remcos build with enhanced real-time surveillance: streaming webcam footage and transmitting keystrokes instantly instead of batching them, reducing forensic residue.
  • CIS Cyber Threat Intelligence discloses the ZPHP campaign delivering Remcos RAT via fake CAPTCHA/ClickFix, impacting U.S. State, Local, Tribal, and Territorial (SLTT) government organizations.
  • SmartApeSG/ZPHP campaign observed delivering four malware families — Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2) — to a single infected host in one session.
  • Reporting discloses a multi-stage phishing chain (ZIP to obfuscated JScript to PowerShell to in-memory .NET reflection loader) injecting the final Remcos payload into aspnet_compiler.exe for C2 communications.
  • Picus Security publishes a deep technical analysis of Remcos RAT operations covering configuration format, C2 protocol internals, UAC bypass, and persistence mechanisms, prompting this hunt.

Sources cited for Remcos RAT: Technical Analysis of Windows Remote Access

Threats related to Remcos RAT: Technical Analysis of Windows Remote Access

Detection coverage for TL-2026-1133

As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1133 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1133

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats