# Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations

> Remcos (Remote Control and Surveillance) is a Windows remote access trojan originally marketed as legitimate remote administration software by Breaking Security in 2016 that has become one of the most prevalent commodity RATs in the wild. It grants an operator near-complete control over an infected machine via keylogging, screenshot/audio/webcam capture, credential and browser data theft, command execution, registry editing, and file management, using process injection, a COM-based UAC bypass, and multi-layered registry/watchdog persistence to evade defenses and survive reboot.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1133
- **ID:** TL-2026-1133
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 48 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Remcos (Remote Control and Surveillance) is a Windows remote access trojan first released in 2016 by the vendor Breaking Security, which continues to market it commercially as a legitimate remote-administration and monitoring tool. Despite this commercial packaging, Remcos has become one of the most prevalent commodity RATs deployed in criminal and espionage operations, tracked by MITRE ATT&CK as Software S0332 since 29 January 2019 and linked to operators ranging from financially motivated crimeware loader ecosystems (SmartApeSG/ZPHP) to the Gorgon Group and Ukraine-focused UAC-0050, with reported historical use by APT33.

Delivery is opportunistic and multi-vector. One documented chain begins with phishing emails carrying a ZIP archive ('MV MERKET COOPER SPECIFICATION.zip') containing an obfuscated JScript loader that contacts almacensantangel.com to retrieve a PowerShell stage (ENCRYPT.Ps1). The PowerShell performs rotating-XOR decryption via a '$masterdecoder' routine to reconstruct a .NET assembly (ALTERNATE.dll) that is loaded reflectively in memory (no disk writes), which in turn injects a final payload (Cqeqpvzeia.exe) into aspnet_compiler.exe for C2 communications. A separate, large-scale chain — tracked as ZPHP/SmartApeSG and observed impacting U.S. State, Local, Tribal, and Territorial (SLTT) government organizations — compromises legitimate websites to serve a fake CAPTCHA page using the ClickFix social-engineering technique: the page silently copies a malicious command to the clipboard and instructs the victim to paste and execute it via the Windows Run dialog, which drops an HTA (%AppData%\post.hta), executed by mshta.exe, that downloads compressed payloads and DLL-side-loads Remcos alongside NetSupport RAT, StealC, and Sectop RAT (ArechClient2) — up to four RAT/stealer families delivered to a single host in one session.

Once running, Remcos stores its configuration RC4-encrypted inside a PE resource named 'SETTINGS' (first byte = key length, followed by the RC4 key and then the ciphertext), with individual configuration fields separated by the delimiter \x7c\x1f\x1e\x1e\x7c. Its C2 protocol is framed with a 0xFF0424 magic header, a 4-byte length field, a 4-byte command ID, and data fields separated by \x1e\x1e\x1f|, transmitted over HTTP or raw TCP — frequently to dynamic-DNS-registered domains (DuckDNS, No-IP/hopto.org, ddns.net) or hardcoded IP:port pairs on both standard and non-standard ports (80, 443, 465, 2404, 2667, 7056, 7902, 8080, 8087).

For privilege escalation, Remcos performs a COM-based UAC bypass: it edits its own Process Environment Block to masquerade as explorer.exe, then calls CoGetObject with an 'Elevation:Administrator!new:' moniker against the CMSTPLUA CLSID to obtain the ICMLuaUtil interface and invoke its ShellExec() method for an elevated relaunch, and can additionally disable UAC outright via 'reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f'. Persistence is layered: registry Run keys (HKCU and HKLM …\CurrentVersion\Run, and …\Policies\Explorer\Run) plus a watchdog process — masquerading as svchost.exe, rmclient.exe, or fsutil.exe — that rewrites the implant's 'EXEpath' registry value and restarts the main process if terminated. Process injection targets trusted hosts (svchost.exe, iexplore.exe) or abused LOLBins (aspnet_compiler.exe) via remote process mapping and process hollowing.

Surveillance capability is extensive and has recently expanded toward near-real-time exfiltration: low-level keyboard hooking (SetWindowsHookExA with WH_KEYBOARD_LL) for keylogging, BitBlt/CreateCompatibleBitmap screenshots (time_YYYYMMDD_HHMMSS.jpg), Windows Wave-API audio recording, and a runtime-injected, disk-never-touching webcam DLL (OpenCamera/CloseCamera/GetFrame/FreeFrame) — with variants observed in early 2026 (tracked in reporting as part of the 'SHADOW#REACTOR' evolution) streaming webcam footage and transmitting keystrokes instantly rather than batching them, reducing forensic residue. Credential-access modules dump browser-stored logins and cookies (Internet Explorer, Firefox, Chrome) via injected helper utilities invoked with a '/sext' parameter and Nirsoft-based history/password extractors, and can optionally wipe that same browser data (deleting container.dat cookie stores) as an anti-forensic 'browser cleaning' routine executed on startup. Discovery functions include installed-application enumeration (via the Software\Microsoft\Windows\CurrentVersion\Uninstall registry hive) and IP-geolocation lookups against the geoplugin.net web service. Remcos additionally exposes live remote shell, file management, registry editing, and a SOCKS5 proxy module for operator network pivoting, all logged locally (observed at C:\ProgramData\remcos\logs.dat) before transmission to the operator's C2 panel.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1218.005 Mshta
- T1218.003 CMSTP
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1055 Process Injection
- T1055.012 Process Hollowing
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1112 Modify Registry
- T1070.004 File Deletion
- T1685 Disable or Modify Tools
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1518 Software Discovery
- T1614 System Location Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1056.001 Keylogging
- T1115 Clipboard Data
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel

## Sources

- [Remcos RAT Analysis: How the Windows Remote Access Trojan Operates](https://www.picussecurity.com/resource/blog/remcos-rat-analysis-how-the-windows-remote-access-trojan-operates)
- [Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four](https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four)
- [Remcos RAT Infection Chain Hides Behind Obfuscated Scripts and Trusted Windows Binaries](https://cybersecuritynews.com/remcos-rat-infection-chain-hides-behind-obfuscated/)
- [ZPHP Campaign Delivering Remcos RAT Impacting SLTTs](https://www.cisecurity.org/insights/blog/zphp-campaign-delivering-remcos-rat-impacting-sltts)
- [SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)](https://isc.sans.edu/diary/SmartApeSG+campaign+pushes+Remcos+RAT+NetSupport+RAT+StealC+and+Sectop+RAT+ArechClient2/32826)
- [SmartApeSG Delivers Remcos, StealC, and Sectop RAT](https://socprime.com/active-threats/smartapesg-delivers-remcos/)
- [UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT](https://thehackernews.com/2024/01/uac-0050-group-using-new-phishing.html)
- [Enhanced Surveillance Functions Signal a Strategic Shift in Remcos RAT Activity](https://www.cysecurity.news/2026/02/enhanced-surveillance-functions-signal.html)
- [Remcos, Software S0332](https://attack.mitre.org/software/S0332/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1133