Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations — Threadlinqs Intelligence
As of 2026-07-05, Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations is a high-severity malware threat attributed to Multiple Threat Actors, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 48 indicators of compromise.
Threat ID: TL-2026-1133 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Multiple Threat Actors · ESPIONAGE
Remcos (Remote Control and Surveillance) is a Windows remote access trojan originally marketed as legitimate remote administration software by Breaking Security in 2016 that has become one of the most
Remcos (Remote Control and Surveillance) is a Windows remote access trojan first released in 2016 by the vendor Breaking Security, which continues to market it commercially as a legitimate remote-administration and monitoring tool. Despite this commercial packaging, Remcos has become one of the most prevalent commodity RATs deployed in criminal and espionage operations, tracked by MITRE ATT&CK as Software S0332 since 29 January 2019 and linked to operators ranging from financially motivated crimeware loader ecosystems (SmartApeSG/ZPHP) to the Gorgon Group and Ukraine-focused UAC-0050, with reported historical use by APT33.
Delivery is opportunistic and multi-vector. One documented chain begins with phishing emails carrying a ZIP archive ('MV MERKET COOPER SPECIFICATION.zip') containing an obfuscated JScript loader that contacts almacensantangel.com to retrieve a PowerShell stage (ENCRYPT.Ps1). The PowerShell performs rotating-XOR decryption via a '$masterdecoder' routine to reconstruct a .NET assembly (ALTERNATE.dll) that is loaded reflectively in memory (no disk writes), which in turn injects a final payload (Cqeqpvzeia.exe) into aspnet_compiler.exe for C2 communications. A separate, large-scale chain — tracked as ZPHP/SmartApeSG and observed impacting U.S. State, Local, Tribal, and Territorial (SLTT) government organizations — compromises legitimate websites to serve a fake CAPTCHA page using the ClickFix social-engineering technique: the page silently copies a malicious command to the clipboard and instructs the victim to paste and execute it via the Windows Run dialog, which drops an HTA (%AppData%\post.hta), executed by mshta.exe, that downloads compressed payloads and DLL-side-loads Remcos alongside NetSupport RAT, StealC, and Sectop RAT (ArechClient2) — up to four RAT/stealer families delivered to a single host in one session.
Once running, Remcos stores its configuration RC4-encrypted inside a PE resource named 'SETTINGS' (first byte = key length, followed by the RC4 key and then the ciphertext), with individual configuration fields separated by the delimiter \x7c\x1f\x1e\x1e\x7c. Its C2 protocol is framed with a 0xFF0424 magic header, a 4-byte length field, a 4-byte command ID, and data fields separated by \x1e\x1e\x1f|, transmitted over HTTP or raw TCP — frequently to dynamic-DNS-registered domains (DuckDNS, No-IP/hopto.org, ddns.net) or hardcoded IP:port pairs on both standard and non-standard ports (80, 443, 465, 2404, 2667, 7056, 7902, 8080, 8087).
For privilege escalation, Remcos performs a COM-based UAC bypass: it edits its own Process Environment Block to masquerade as explorer.exe, then calls CoGetObject with an 'Elevation:Administrator!new:' moniker against the CMSTPLUA CLSID to obtain the ICMLuaUtil interface and invoke its ShellExec() method for an elevated relaunch, and can additionally disable UAC outright via 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f'. Persistence is layered: registry Run keys (HKCU and HKLM …\CurrentVersion\Run, and …\Policies\Explorer\Run) plus a watchdog process — masquerading as svchost.exe, rmclient.exe, or fsutil.exe — that rewrites the implant's 'EXEpath' registry value and restarts the main process if terminated. Process injection targets trusted hosts (svchost.exe, iexplore.exe) or abused LOLBins (aspnet_compiler.exe) via remote process mapping and process hollowing.
Surveillance capability is extensive and has recently expanded toward near-real-time exfiltration: low-level keyboard hooking (SetWindowsHookExA with WH_KEYBOARD_LL) for keylogging, BitBlt/CreateCompatibleBitmap screenshots (time_YYYYMMDD_HHMMSS.jpg), Windows Wave-API audio recording, and a runtime-injected, disk-never-touching webcam DLL (OpenCamera/CloseCamera/GetFrame/FreeFrame) — with variants observed in early 2026 (tracked in reporting as part of the 'SHADOW#REACTOR' evolution) streaming webcam footage and transmitting keystrokes instantly
Target sectors: government administration, state-local-tribal-territorial-government, critical-infrastructure, technology, finance, education
Target regions: North America, Europe, ukraine, Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 48 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583.001, T1566.001, T1566.002, T1189, T1204.004, T1059.001, T1059.003, T1059.005, T1059.007, T1218.005