ThreatResearch

Extractores de Configuración Algunos scripts utilizados por nuestro equipo para extraer configuraciones de algunas muestras analizadas. PlugX Remcos templateX RedLine Stealer...

volatility

This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3 ============================================================================ Volatility Framework - Volatile memory extraction utility framework The Volatility Framework is a...

remcos-decoder

Talos Decryptor POC for Remcos RAT 版本 2.0.5 及更早版本 查看 ./remcosdecryptor.py -h 以获取帮助。 免责声明：本工具不提供任何担保。使用风险自负。...

CVE-2017-11882-Possible-Remcos-Malspam

Este repositorio no tiene un README...

-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – 通过原生 API 调用实现 svchost 注入 以下 Binary Ninja 代码片段揭示了 Remcos 将其载荷注入 svchost.exe 的核心注入机制。 代码功能说明： CreateProcessW 使用 CREATESUSPENDED 标志启动一个处于挂起状态的 svchost 进程。 VirtualAlloc 在目标进程内使用 MEMCOMMIT 和 PAGEREADWRITE 标志分配内存，允许将载荷直接写入进程内存。 WriteProcessMemory 将载荷写入挂起的 svchost 进程的已分配内存区域。...

New XWorm 7.1 and Remcos RAT Attacks Abuse Windows Tools to Evade Detection

New XWorm 7.1 and Remcos RAT campaigns abuse trusted Windows tools to evade detection. The attacks exploit a WinRAR flaw and use process hollowing to spy on victims...

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution By Madhini Muralidharan · March 11, 2026 Traditional malware campaigns rely heavily on dropping executable files to disk—artifacts that defenders can scan, quarantine, and analyze with signature-based security tools. Mode...

Can you use too many LOLBins to drop some RATs?

Recently, our team came across an infection attempt that stood out—not for its sophistication, but for how determined the attacker was to take a “living off the land” approach to the extreme. The end goal was to deploy Remcos , a Remote Access Trojan RAT, and NetSupport Manager , a legitimate...

Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

Security experts have disclosed details of an active malware campaign that's exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares library to bypass security controls and deliver a wide range of commodity trojans and stealers. "Attackers achieve...

New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack

Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOWREACTOR that employs an evasive multi-stage attack chain to deliver a commercially available remote administration tool called Remcos RAT and establish persistent, covert remote access. "The infection chain follows a...

Fake Employee Reports Spread Guloader and Remcos RAT Malware

Scammers are using fake October 2025 performance reviews to trick staff into installing Guloader and Remcos RAT malware. Learn how to identify this threat and protect your personal data from remote hackers...

Russia-Aligned Hackers Abuse Viber to Target Ukrainian Military and Government

The Russia-aligned threat actor known as UAC-0184 has been observed targeting Ukrainian military and government entities by leveraging the Viber messaging platform to deliver malicious ZIP archives. "This organization has continued to conduct high-intensity intelligence gathering activities again...

New Attack Uses Windows Shortcut Files to Install REMCOS Backdoor

Security firm Point Wild has exposed a new malware campaign using malicious LNK files to install the REMCOS backdoor. This report details how attackers disguise files to gain full system control...

New Stealthy Remcos Malware Campaigns Target Businesses and Schools

Forcepoint's X-Labs reveals Remcos malware using new tricky phishing emails from compromised accounts and advanced evasion techniques like…...

New Phishing Campaign Uses DBatLoader to Drop Remcos RAT: What Analysts Need to Know

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings...

Fileless Remcos RAT Delivered via LNK Files and MSHTA in PowerShell-Based Attacks

Cybersecurity researchers have shed light on a new malware campaign that makes use of a PowerShell-based shellcode loader to deploy a remote access trojan called Remcos RAT. "Threat actors delivered malicious LNK files embedded within ZIP archives, often disguised as Office documents," Qualys...

Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT

Cybercriminals are progressively turning PowerShell to launch stealthy attacks that evade traditional antivirus and endpoint defenses. By running code directly in memory, these threats leave minimal evidence on disk, making them particularly challenging to detect. A recent example is Remcos RAT, ...

Fileless Remcos RAT Attack Evades Antivirus Using PowerShell Scripts

A new wave of attacks uses PowerShell and LNK files to secretly install Remcos RAT, enabling full remote…...

FakeUpdates, Remcos, AgentTesla Top Malware Charts in Stealth Attack Surge

Check Point's April 2025 malware report reveals increasingly sophisticated and hidden attacks using familiar malware like FakeUpdates, Remcos,…...

Russia-Linked Gamaredon Uses Troop-Related Lures to Deploy Remcos RAT in Ukraine

Entities in Ukraine have been targeted as part of a phishing campaign designed to distribute a remote access trojan called Remcos RAT. "The file names use Russian words related to the movement of troops in Ukraine as a lure," Cisco Talos researcher Guilherme Venere said in a report published last...