RAT / stealerATT&CK S0332
Remcos
Also known as: Remcos RAT
Remcos is sold as legitimate remote control and surveillance software but is widely abused as a remote access trojan, delivered through phishing. Once installed it gives full remote control, keylogging, and microphone and webcam capture. CISA listed it among the top malware strains of 2021.
- Public attribution and associated actors
- Marketed commercially as remote administration software but widely abused; MITRE ATT&CK lists Gamaredon Group, APT-C-36 and others as users.As publicly reported:Gamaredon GroupAPT-C-36
- First seen
- Around 2016
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0332 Remcos
How it spreads or gets in
- Phishing attachments, often Office documents or archives that run a downloader.
Key behaviours
- Logged keystrokes and captured audio, video and screenshots.
- Bypassed User Account Control to gain higher privileges.
- Persisted through Run keys.
ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1204.002User Execution: Malicious File
- T1056.001Input Capture: Keylogging
- T1123Audio Capture
- T1125Video Capture
- T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Detect UAC bypass patterns, such as auto-elevating binaries launching unusual children.
- Alert on unknown processes accessing the microphone or webcam.
- Flag new Run-key entries pointing at user folders.
Defences that work
- Filter attachments and block macros from the internet.
- Run users without local admin rights and with UAC at its highest setting.
- Allow only approved remote administration tools.