Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign Impersonating Payment Confirmations
Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign (TL-2026-1252) is a high-severity malware campaign scored CVSS 7.8, first published 2026-07-13. It has no confirmed attribution, affects Microsoft Microsoft Office, references 1 CVE (CVE-2017-0199), maps to 32 MITRE ATT&CK techniques (T1010, T1012, T1027), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-1252
- Threat ID
- TL-2026-1252
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-13
- Last reviewed
- 2026-07-13
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, businessservices, generalenterprise
- Target regions
- south korea, Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign
Malware and tooling: Remcos
AhnLab ASEC identified an active phishing campaign distributing XLS files disguised as payment confirmations that exploit CVE-2017-0199 (Microsoft Office OLE2Link RCE) to trigger a multi-stage infection chain — malicious HTA, obfuscated PowerShell, and a steganographically-embedded .NET loader — ultimately deploying Remcos RAT for keylogging, screen/audio/video capture, and remote command execution.
How Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign works
On 2026-07-10, AhnLab Security intelligence Center (ASEC) published analysis of a phishing campaign impersonating Korean company employees, distributing malicious XLS attachments disguised as payment/money-transfer confirmations. The lure document exploits CVE-2017-0199, a Microsoft Office/WordPad remote code execution vulnerability in the handling of OLE2Link objects: opening the document causes Office to silently issue an HTTP request to attacker infrastructure and retrieve an HTA (HTML Application) file disguised with a benign-looking name.
The retrieved HTA executes an obfuscated PowerShell script via WMI's Win32_Process.Create() method, a technique commonly used to spawn a process without going through cmd.exe or a visible parent-child relationship that would otherwise be flagged by simpler EDR heuristics. The PowerShell stage then downloads a PNG image from a Cloudflare Workers-hosted subdomain; the image is not a decoy — it uses steganography to embed a Base64-encoded .NET loader between the delimiter strings "IN-" and "-inl". PowerShell extracts, decodes, and reflectively loads this .NET assembly in memory.
The .NET loader is a dropper/injector for Remcos RAT, a widely available closed-source "remote administration and surveillance" tool developed by Breaking Security and long abused as a commodity RAT by financially motivated criminal actors as well as some APT groups. Once deployed, Remcos establishes persistence via a registry Run key, disables/evades User Account Control where possible, and beacons to a DuckDNS dynamic-DNS C2 endpoint over a custom binary protocol. Post-infection capabilities observed for Remcos in this and prior campaigns include keystroke logging, clipboard capture, screen/audio/webcam capture, remote shell, file management, registry editing, and payload staging for follow-on tooling.
CVE-2017-0199 is a mature, well-understood vulnerability (patched by Microsoft in April 2017 and listed in the CISA Known Exploited Vulnerabilities catalog since 2021) that continues to see active criminal and APT re-use nearly a decade later because a large population of legacy/unpatched Office and Windows installs remains exploitable and the exploit reliably bypasses user-interaction expectations (no macro-enable prompt, no protected-view bypass required in many configurations). The persistence of this specific 1-click/no-click OLE technique in 2026 campaigns indicates patch-hygiene gaps are still being actively harvested by RAT-as-a-service operators.
MITRE ATT&CK techniques used in TL-2026-1252
Discovery
T1010 Application Window Discovery; T1012 Query Registry; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1204 User Execution
Credential Access
Command and Control
T1090 Proxy; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1568 Dynamic Resolution; T1573 Encrypted Channel
Collection
T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture; T1560 Archive Collected Data
execution
T1203 Exploitation for Client Execution
Impact
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Initial Access
Affected products and versions in Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign
- Microsoft — Microsoft Office
Vulnerable versions: Office 2007 SP3; Office 2010 SP2; Office 2013 SP1; Office 2016
Fixed in: April 2017 security update (CVE-2017-0199) - Microsoft — WordPad / Windows
Vulnerable versions: Windows Vista SP2; Windows Server 2008 SP2; Windows 7 SP1; Windows 8.1
Fixed in: April 2017 security update (CVE-2017-0199) - Philips — IntelliSpace Portal
Vulnerable versions: 7.0; 8.0
Fixed in: Vendor-supplied Office component update
Remediation for Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign
Patches
- Microsoft Security Bulletin for CVE-2017-0199 (April 11, 2017) — apply to all supported Office/Windows builds
Immediate actions
- Block IOC IP 144.172.104.196 and the associated URI paths at network egress
- Block/sinkhole the DuckDNS C2 hostname guhudeolokghguhumandeylikebroemdfhhfhsjj.duckdns.org, particularly on port 4087
- Block or alert on the Cloudflare Workers staging subdomain blue-paper-f69f.acrypters.workers.dev
- Hunt for the 4 published MD5 hashes across EDR/AV telemetry and email gateway attachment logs
- Quarantine and analyze inbound XLS attachments referencing payment confirmation, money transfer, or remittance themes
- Alert on wmiprvse.exe/WmiPrvSE spawning powershell.exe or mshta.exe, and on Win32_Process Create calls originating from Office processes
Workarounds
- Disable the WordPad/OLE2Link package activation via Microsoft Fix It / registry workaround where patching is not immediately possible
- Block .hta file execution via AppLocker/WDAC and disable mshta.exe for standard users
Longer-term hardening
- Apply MS17-010/security update for CVE-2017-0199 (April 2017 Patch Tuesday) to all Office/WordPad installs still unpatched
- Enforce Office Protected View and disable automatic OLE object activation via Group Policy / registry (FEATURE_BLOCK_OLE_EMBEDDED_OBJECT)
- Deploy attachment sandboxing/detonation for inbound XLS/XLSM/RTF/DOC attachments at the email gateway
- Implement PowerShell Constrained Language Mode and Script Block Logging to detect obfuscated PowerShell execution
- Deploy network detection for DuckDNS and other free dynamic-DNS providers used as C2 rendezvous points
- Deploy EDR rules for reflective .NET assembly loading and in-memory execution from non-standard PE sources
CVEs associated with Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign
Weaknesses (CWE) in Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign
NVD-CWE-noinfo
Timeline of Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign
- Proofpoint documents APT exploitation of CVE-2017-0199 against financial analysts prior to public patch availability.
- Microsoft discloses and patches CVE-2017-0199 (OLE2Link RCE) in the April 2017 Patch Tuesday release.
- APT19 begins using RTF attachments exploiting CVE-2017-0199, later pivoting to macro-enabled XLSM lures by end of May 2017.
- CISA adds CVE-2017-0199 to the Known Exploited Vulnerabilities (KEV) catalog, confirming continued active exploitation years after patch release.
- ASEC identifies the final Remcos RAT C2 rendezvous point at a DuckDNS dynamic-DNS hostname on port 4087.
- ASEC identifies the steganographic PNG payload hosted on a Cloudflare Workers subdomain (blue-paper-f69f.acrypters.workers.dev), embedding a Base64-encoded .NET loader between IN-/-inl delimiters.
- ASEC identifies the HTA download path at 144.172.104.196 delivering the first-stage loader (Smallbackpackcomingfromthebestplaces.hta).
- AhnLab ASEC publishes analysis of an active phishing campaign using XLS payment-confirmation lures exploiting CVE-2017-0199 to deliver Remcos RAT via an HTA -> PowerShell -> steganographic .NET loader chain.
- TL-Intel Harness ingests the ASEC report via RSS hunt phase and opens threat record TL-2026-1252.
Sources cited for Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign
- Distribution of Remcos RAT Disguised as Payment Confirmation via CVE-2017-0199
- NVD - CVE-2017-0199
- Microsoft Security Response Center Update Guide - CVE-2017-0199
- CVE-2017-0199 Vulnerability: Analysis, Impact, Mitigation
- Remcos, Software S0332
- Cisco Talos Coverage for CVE-2017-0199
- APT Targets Financial Analysts with CVE-2017-0199
- Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four
- Censys Threat Overview: Mapping Remcos C2 Activity at Internet Scale
- Remcos RAT: Network Artifacts, C2 Command Analysis & SASE Mitigation
Threats related to Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign
- The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWorm
- Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign
- MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL Sideloading
- MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials
- Operation DragonReturn — China-Nexus DcRAT Multi-Stage Espionage Campaign Targeting Govt. of India Ministry of Finance / Income Tax Infrastructure
- MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass and Multi-Browser Session Hijacking
Detection coverage for TL-2026-1252
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1252 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1252
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.