# Remcos RAT phishing campaign disguised as project material purchase requests exploits CVE-2017-0199 against Korean companies

> AhnLab ASEC reports phishing emails impersonating employees of a Korean company and posing as project material purchase requests. A malicious XLS attachment exploits CVE-2017-0199 to fetch an HTA file that runs obfuscated PowerShell, pulls a steganographic PNG, extracts a Base64 .NET loader and deploys Remcos RAT. No threat actor attribution is given.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-09-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2764
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-remcos-rat-korean-campaign-tl-2026-2764.webp?v=c4d4a7cf (Threadlinqs threat intel: Remcos RAT Targets Korean Companies: Detection & IOCs (TL-2026-2764) — High severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-2764
- **Severity:** HIGH (CVSS 7.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)
- **CVEs:** CVE-2017-0199

## Description

On 2026-09-28 AhnLab Security Intelligence Center (ASEC) documented a phishing campaign in which emails impersonate employees of a specific company in Korea and present themselves as project material purchase requests. The attached XLS is disguised as a project material purchase request form and shows legitimate-looking purchase content as a decoy to lower the recipient's suspicion.

When the XLS is opened it exploits CVE-2017-0199, an OLE2Link handling flaw in Microsoft Office/WordPad, to download an HTA file from an attacker-hosted server (hxxp://172.245.209.133/70/Weprovideforbesthingstocomebackgoodthings.Hta). The HTA executes obfuscated PowerShell in the background through WMI Win32_Process.Create(). The decoded PowerShell downloads a steganographic PNG from a Cloudflare Workers hosted URL (muddy-sound-e0cd.nodetectonn.workers.dev/HIsPq), locates a Base64-encoded .NET loader embedded in the image using the marker strings "IN-" and "-inl", decodes it and loads it into memory, passing the C2 address as an argument.

The .NET loader then downloads and executes the Remcos RAT payload (served from the same IP as Img_201031.Png). Remcos connects to the dynamic-DNS C2 blessedongrace.duckdns.org on TCP port 19700 and receives and executes remote commands, with keylogging, screen capture, file manipulation and system/user information collection; collected data is sent to the C2.

The technique chain (malicious Excel, CVE-2017-0199, HTA, multi-layer scripting, in-memory Remcos) resembles the fileless Remcos variant Fortinet reported in November 2024 (HTA cookienetbookinetcahce.hta from 192.3.220.22, purchase-order lure), but ASEC does not link the two campaigns or attribute this activity to any actor. ASEC has also published a structurally similar Remcos campaign (Excel lure, CVE-2017-0199, HTA, PowerShell, steganographic PNG, .NET loader) using different infrastructure; no infrastructure overlap with this campaign was identified. CVE-2017-0199 was patched by Microsoft in April 2017 and is listed in the CISA KEV catalog; unpatched Office installations remain exposed. Severity is analyst-assigned; the CVSS score shown is the NVD 3.1 base score for CVE-2017-0199, not for the campaign.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1684.001 Impersonation
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution
- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1218.005 Mshta
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1056.001 Keylogging
- T1113 Screen Capture
- T1568 Dynamic Resolution

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Office Application Spawning Script Host - CVE-2017-0199 Remcos Chain** (`TL-2026-2764-SPL-001`)

Detects Excel, Word, WordPad or PowerPoint spawning mshta.exe, PowerShell, WScript/CScript or cmd.exe, the execution hand-off after a malicious XLS exploits CVE-2017-0199 (OLE2Link) to fetch an HTA. Also matches ASEC campaign command-line IOCs (Weprovideforbesthingstocomebackgoodthings.Hta, 172.245.209.133) and the ASEC sample hashes plus the community-observed sibling Remcos SHA256 (9d9f149a...). Office spawning a script host is almost never legitimate on a workstation, so this is the highest-signal exploitation-stage alert.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1203, T1218.005
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```CVE-2017-0199 OLE2Link chain - Office/WordPad spawning mshta or script hosts, plus ASEC 2026-09-28 campaign IOCs```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(((ParentImage="*EXCEL.EXE" OR ParentImage="*WINWORD.EXE" OR ParentImage="*WORDPAD.EXE" OR ParentImage="*POWERPNT.EXE") (Image="*mshta.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*cmd.exe")) OR CommandLine="*Weprovideforbesthingstocomebackgoodthings*" OR CommandLine="*172.245.209.133*" OR Hashes="*5055c7b0ae1f6f77b16eb744a76cc453*" OR Hashes="*623bc9114d118592170599585e5cf60e*" OR Hashes="*db9ff235eae552276b12622ae9105f1c*" OR Hashes="*9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45*")
| stats count min(_time) as first_seen values(ParentCommandLine) as parent_cmd values(CommandLine) as cmd by host, User, ParentImage, Image
| convert ctime(first_seen)
````

### Microsoft KQL

```kql
// CVE-2017-0199 chain: Office/WordPad spawning mshta or script hosts, plus ASEC campaign IOCs
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName in~ ("excel.exe", "winword.exe", "wordpad.exe", "powerpnt.exe") and FileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe"))
    or ProcessCommandLine has_any ("Weprovideforbesthingstocomebackgoodthings", "172.245.209.133")
    or MD5 in~ ("5055c7b0ae1f6f77b16eb744a76cc453", "623bc9114d118592170599585e5cf60e", "db9ff235eae552276b12622ae9105f1c")
    or SHA256 =~ "9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, MD5, SHA256
```

### Sigma

```yaml
title: Office Application Spawning Script Host - CVE-2017-0199 Remcos Chain
id: 3f6a1c52-8b7d-4e21-9a34-5d0c7e8f1a01
status: experimental
description: Detects Excel/Word/WordPad/PowerPoint spawning mshta or script interpreters after CVE-2017-0199 exploitation, or campaign IOCs from the ASEC Remcos purchase-request phishing campaign.
references:
    - https://asec.ahnlab.com/en/95598/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-0199
author: Threadlinqs Team
date: 2026/09/29
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1203
    - attack.defense_evasion
    - attack.t1218.005
    - attack.s0332
    - cve.2017.0199
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\EXCEL.EXE'
            - '\WINWORD.EXE'
            - '\WORDPAD.EXE'
            - '\POWERPNT.EXE'
    selection_child:
        Image|endswith:
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    selection_ioc:
        CommandLine|contains:
            - 'Weprovideforbesthingstocomebackgoodthings'
            - '172.245.209.133'
    selection_hash:
        Hashes|contains:
            - '5055c7b0ae1f6f77b16eb744a76cc453'
            - '623bc9114d118592170599585e5cf60e'
            - 'db9ff235eae552276b12622ae9105f1c'
            - '9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45'
    condition: (selection_parent and selection_child) or selection_ioc or selection_hash
falsepositives:
    - Office macros or add-ins that legitimately launch cmd.exe or PowerShell (finance or ERP automation)
level: high
```

**Known false positives:**

- Legitimate Office VBA macros or COM add-ins that shell out to cmd.exe or PowerShell (ERP/finance automation)

**Tuning notes:** Exclude documented internal automation by ParentCommandLine or signed macro path; drop cmd.exe from the child list if noisy. Keep mshta/wscript/cscript/PowerShell children unfiltered. Sysmon Hashes field must include MD5/SHA256 (HashType config).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MSHTA Executing Remote HTA From HTTP URL - CVE-2017-0199 Stage (locked: unlock with TL Creds)
- PowerShell Script Block - Steganographic PNG Loader Markers (IN- / -inl) (locked: unlock with TL Creds)
- Remcos Staging Infrastructure Access - HTA, PNG and workers.dev Hosts (locked: unlock with TL Creds)
- Office Application Writing HTA File - CVE-2017-0199 OLE2Link Download (locked: unlock with TL Creds)
- PowerShell Download Of PNG Followed By In-Memory .NET Assembly Load (locked: unlock with TL Creds)
- Remcos RAT Registry Artifact - Software\Remcos-<ID> Key (locked: unlock with TL Creds)
- WMI- or MSHTA-Spawned Obfuscated PowerShell - Remcos HTA Stage (locked: unlock with TL Creds)
- Remcos C2 Beacon - DuckDNS / TCP 19700 From Non-Browser Process (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `172.245.209[.]133`
- Domain: `muddy-sound-e0cd[.]nodetectonn[.]workers[.]dev`
- File hash: `5055c7b0ae1f6f77b16eb744a76cc453`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests (AhnLab ASEC)](https://asec.ahnlab.com/en/95598/)
- [NVD - CVE-2017-0199](https://nvd.nist.gov/vuln/detail/CVE-2017-0199)
- [Microsoft MSRC advisory - CVE-2017-0199](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Cybercriminals Use Excel Exploit to Spread Fileless Remcos RAT (The Hacker News)](https://thehackernews.com/2024/11/cybercriminals-use-excel-exploit-to.html)
- [A new fileless variant of Remcos RAT observed in the wild (Security Affairs)](https://securityaffairs.com/?p=170791)
- [New Remcos RAT Activity Detection: Phishing Campaign Spreading a Novel Fileless Malware Variant (SOC Prime)](https://socprime.com/blog/new-remcos-rat-activity-detection/)
- [Beware of Phishing Emails Disguised as Money Transfer Confirmations (AhnLab ASEC)](https://asec.ahnlab.com/en/94432/)
- [Microsoft Patch Tuesday fixes three flaws actively exploited in attacks in the wild (Security Affairs)](https://securityaffairs.com/57947/hacking/microsoft-patch-tuesday.html)
- [CVE-2017-0199 coverage (Cisco Talos)](https://blogs.cisco.com/security/cve-2017-0199-coverage/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2764