Loading story…
A malicious ZIP archive has been observed delivering Remcos RAT through a multi-stage infection chain that starts with a VHDX disk image instead of a more common document or executable. When opened on modern Windows systems, the embedded VHDX auto-mounts and exposes an obfuscated JavaScript file, Partnerschaft_fur_neue_Angebotsanfrage.js, suggesting possible targeting of German-speaking users. Researchers said the use of a mountable virtual disk reduces user friction and helps the malware bypass some first-line security controls; the ZIP sample was identified with SHA-256 a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094.
The JavaScript launches PowerShell through WMI to make process relationships less suspicious, after which additional PowerShell stages use string pollution, selective character extraction, Base64 decoding, and XOR decryption with the key Identificational. The chain then retrieves follow-on payloads from cembusconfort[.]ro, uses a reflective .NET loader and shellcode to fetch the final malware, injects it into backgroundTaskHost.exe, and establishes persistence with an HKCU Run key that re-executes the PowerShell loader. The final payload communicates with animal342[.]duckdns[.]org:53552, and multiple stages reportedly showed weak antivirus detection, including the JavaScript sample, which had only 5/57 detections on VirusTotal.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
A SANS Internet Storm Center diary described a malicious ZIP archive that used a VHDX disk image to deliver Remcos RAT through JavaScript, PowerShell, a reflective .NET loader, and shellcode. The report also published technical details including the likely German-language lure, persistence via an HKCU Run key, and C2 infrastructure at animal342[.]duckdns[.]org:53552.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Researchers and incident reports show **Remcos RAT** continuing to spread through multiple delivery channels, including business-themed phishing emails, fake cryptocurrency software, and multi-stage script loaders. Trend Micro documented a phishing campaign using an ACE archive attachment and an AutoIt-based loader to install **Remcos Professional 1.7**, while ESET reported a spoofed SafeMoon application that delivered Remcos to cryptocurrency users. SonicWall later identified a newer infection chain using VBScript, batch files, PowerShell, and a .NET loader to deploy Remcos after patching **AMSI** and **ETW** for defense evasion, with observed targeting of European institutions. Technical analysis from Elastic Security Labs found that modern Remcos samples retain extensive remote-access and surveillance functions, including **keylogging, screenshots, audio capture, webcam access, shell command execution, password theft, browser-history collection, persistence, process injection, and UAC bypass**. Elastic recovered most of the malware’s configuration structure and command set, showing that Remcos stores encrypted settings, supports TLS-enabled command-and-control, can masquerade as legitimate processes such as `explorer.exe`, and can clean browser artifacts or uninstall itself on command. The reporting underscores how a tool originally marketed for red teaming has become a widely abused malware family with increasingly evasive delivery chains and mature post-compromise control features.
Aug 14, 2026