RemCom
RemCom is an open-source remote execution utility for Windows, commonly described as a remote shell or telnet replacement and an open-source replacement for PsExec. It allows execution of processes on remote Windows systems and is commonly used by attackers for lateral movement and remote service-based execution within compromised networks. The content references detections and telemetry associated with RemCom activity, including Windows service creation events such as RemComSvc and datasets covering Windows Security, Sysmon, and System logs. RemCom has been observed in post-exploitation activity by multiple threat actors. Microsoft reported that MERCURY, now tracked as Mango Sandstorm and assessed with high confidence to be affiliated with Iran’s MOIS, used remote services with RemCom to run encoded PowerShell commands on internal systems after exploiting Log4j 2 vulnerabilities in SysAid Server instances targeting organizations in Israel. APT39 has used RemCom alongside NSSM to execute processes and for lateral movement, particularly in intrusions targeting telecommunications and travel organizations and other entities aligned with Iranian national interests. CrowdStrike reported that FANCY BEAR/APT28 used RemCOM to deploy tools during the 2016 DNC intrusion. Palo Alto Networks reported Stately Taurus (also known as Mustang Panda, BRONZE PRESIDENT, TA416, RedDelta, and Earth Preta) used RemCom for remote execution of exfiltration tools on uncompromised hosts during a long-running cyberespionage campaign against a Southeast Asian government. ESET also reported that IsaacWiper targeted specific machines previously compromised with RemCom, which was described as being used by attackers for lateral movement within compromised networks. High-confidence indicators directly mentioned in the content include the service name RemComSvc and the existence of SHA-256 hashes for RemCom shared by Microsoft in related intrusion reporting, though the specific hash values are not provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Remote services (leveraging RemCom tool) to run encoded PowerShell commands within organizations.
APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique"obtained and leveraged publicly-available tools for intrusion activities."
Execution
1 techniqueThe following analytic identifies the execution of RemCom.exe, an open-source alternative to PsExec, used for lateral movement and remote command execution.
Persistence
1 techniquePrivilege Escalation
1 techniqueCredential Access
1 techniqueConsistent with GRU techniques and 'methods of persistence' identified by computer forensic investigators in other intrusions, the hackers again used X-Agent to log keystrokes, take screenshots, and gather system data; used a lateral-movement tool called RemCom; and used Mimikatz, a credential-harvesting tool.
Lateral Movement
3 techniquesExample-script execution artifacts 7 psexec.py , smbexec.py , atexec.py , dcomexec.py , RemCom artifacts
Remote services (leveraging RemCom tool) to run encoded PowerShell commands within organizations.
Description Atomic Testing of Remcom MITRE ATT&CK Techniques ... The following datasets were collected during this attack simulation: ... /datasets/attack_techniques/T1570/remcom/
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RemCom is a remote shell tool used for executing processes on remote Windows systems, facilitating lateral movement and remote command execution.
Remote execution utility used to launch commands on other systems for lateral movement and post-compromise operations.
Remote administration tool used by attackers for lateral movement; mentioned as a precursor tool present on systems later hit by IsaacWiper.
Datasets ... 4688-Remcom-Windows-Security ... Remcom_windows-System ... Related Detections ... Windows Service Create RemComSvc
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.