# Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign Impersonating Payment Confirmations

> AhnLab ASEC identified an active phishing campaign distributing XLS files disguised as payment confirmations that exploit CVE-2017-0199 (Microsoft Office OLE2Link RCE) to trigger a multi-stage infection chain — malicious HTA, obfuscated PowerShell, and a steganographically-embedded .NET loader — ultimately deploying Remcos RAT for keylogging, screen/audio/video capture, and remote command execution.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1252
- **ID:** TL-2026-1252
- **Severity:** HIGH (CVSS 7.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-0199

## Description

On 2026-07-10, AhnLab Security intelligence Center (ASEC) published analysis of a phishing campaign impersonating Korean company employees, distributing malicious XLS attachments disguised as payment/money-transfer confirmations. The lure document exploits CVE-2017-0199, a Microsoft Office/WordPad remote code execution vulnerability in the handling of OLE2Link objects: opening the document causes Office to silently issue an HTTP request to attacker infrastructure and retrieve an HTA (HTML Application) file disguised with a benign-looking name.

The retrieved HTA executes an obfuscated PowerShell script via WMI's Win32_Process.Create() method, a technique commonly used to spawn a process without going through cmd.exe or a visible parent-child relationship that would otherwise be flagged by simpler EDR heuristics. The PowerShell stage then downloads a PNG image from a Cloudflare Workers-hosted subdomain; the image is not a decoy — it uses steganography to embed a Base64-encoded .NET loader between the delimiter strings "IN-" and "-inl". PowerShell extracts, decodes, and reflectively loads this .NET assembly in memory.

The .NET loader is a dropper/injector for Remcos RAT, a widely available closed-source "remote administration and surveillance" tool developed by Breaking Security and long abused as a commodity RAT by financially motivated criminal actors as well as some APT groups. Once deployed, Remcos establishes persistence via a registry Run key, disables/evades User Account Control where possible, and beacons to a DuckDNS dynamic-DNS C2 endpoint over a custom binary protocol. Post-infection capabilities observed for Remcos in this and prior campaigns include keystroke logging, clipboard capture, screen/audio/webcam capture, remote shell, file management, registry editing, and payload staging for follow-on tooling.

CVE-2017-0199 is a mature, well-understood vulnerability (patched by Microsoft in April 2017 and listed in the CISA Known Exploited Vulnerabilities catalog since 2021) that continues to see active criminal and APT re-use nearly a decade later because a large population of legacy/unpatched Office and Windows installs remains exploitable and the exploit reliably bypasses user-interaction expectations (no macro-enable prompt, no protected-view bypass required in many configurations). The persistence of this specific 1-click/no-click OLE technique in 2026 campaigns indicates patch-hygiene gaps are still being actively harvested by RAT-as-a-service operators.

## MITRE ATT&CK

- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1620 Reflective Code Loading
- T1056 Input Capture
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1010 Application Window Discovery
- T1012 Query Registry
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1115 Clipboard Data
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1090 Proxy
- T1132 Data Encoding
- T1529 System Shutdown/Reboot

## Sources

- [Distribution of Remcos RAT Disguised as Payment Confirmation via CVE-2017-0199](https://asec.ahnlab.com/en/94432/)
- [NVD - CVE-2017-0199](https://nvd.nist.gov/vuln/detail/cve-2017-0199)
- [Microsoft Security Response Center Update Guide - CVE-2017-0199](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-0199)
- [CVE-2017-0199 Vulnerability: Analysis, Impact, Mitigation](https://www.huntress.com/threat-library/vulnerabilities/cve-2017-0199)
- [Remcos, Software S0332](https://attack.mitre.org/software/S0332/)
- [Cisco Talos Coverage for CVE-2017-0199](https://blog.talosintelligence.com/cve-2017-0199/)
- [APT Targets Financial Analysts with CVE-2017-0199](https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts)
- [Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four](https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four)
- [Censys Threat Overview: Mapping Remcos C2 Activity at Internet Scale](https://censys.com/blog/threat-overview-remcos-c2/)
- [Remcos RAT: Network Artifacts, C2 Command Analysis & SASE Mitigation](https://www.aryaka.com/blog/remcos-rat-network-c2-analysis/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1252