Remsec
MITRE ATT&CK: S0125 View on attack.mitre.org
Aliases: Backdoor.Remsec, ProjectSauron, Remsec
- First seen
- 2011-03-01 00:00:00
- Malware type
- backdoor, spyware
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 50 (43 malicious)
- Last IoC activity
- 2026-10-18 00:40:22
- Profile updated
- 2026-07-07 15:44:54
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:ru country_code:cn country_code:us
Context
Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua.
Recent IoC activity
43 malicious indicators in Maltiverse are attributed to Remsec (S0125). The 20 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | ns-2.open.ro | 2026-10-18 | 1 |
| hostname | autodiscover.it | 2026-10-18 | 1 |
| hostname | webdisk.cn | 2026-10-18 | 1 |
| hostname | mail.news | 2026-10-18 | 1 |
| hostname | autodiscover.store | 2026-10-18 | 1 |
| hostname | admin.dev | 2026-10-18 | 1 |
| hostname | secure.dev | 2026-10-18 | 1 |
| hostname | autoconfig.de | 2026-10-18 | 1 |
| hostname | prod.tools | 2026-10-17 | 1 |
| hostname | autodiscover.host | 2026-10-17 | 1 |
| hostname | autodiscover.es | 2026-10-17 | 2 |
| hostname | autodiscover.online | 2026-10-17 | 1 |
| hostname | webdisk.de | 2026-10-17 | 1 |
| hostname | autodiscover.de | 2026-10-17 | 1 |
| hostname | webdisk.us | 2026-10-17 | 1 |
| hostname | autodiscover.cn | 2026-10-17 | 2 |
| hostname | mail.blog | 2026-10-17 | 1 |
| hostname | autoconfig.online | 2026-10-17 | 1 |
| hostname | test.support | 2026-10-17 | 1 |
| hostname | ns-3.open.ro | 2026-10-17 | 1 |
Detection coverage
- 1 YARA rules
- 410 Sigma rules
Malware & tools used
- Dynamic-link Library Injection (attack-pattern)
- Exploitation for Privilege Escalation (attack-pattern)
- Exfiltration over USB (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Windows Host Firewall (attack-pattern)
- Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)
- System Network Connections Discovery (attack-pattern)
- File Deletion (attack-pattern)
- Keylogging (attack-pattern)
- Process Discovery (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- Password Filter DLL (attack-pattern)
- Match Legitimate Resource Name or Location (attack-pattern)
- Non-Application Layer Protocol (attack-pattern)
- Remote System Discovery (attack-pattern)
- Mail Protocols (attack-pattern)
- Lua (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Security Account Manager (attack-pattern)
- Data from Removable Media (attack-pattern)
- Scheduled Task (attack-pattern)
- System Information Discovery (attack-pattern)
- Local Account (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- System Owner/User Discovery (attack-pattern)
Used by threat actors
- Strider (threat-actor)
Detection rules
- MALPEDIA_Win_Remsec_Strider_Auto (yara-rule)
Reports & references
- Broadcom/Symantec — Viewdocument (report)
- Broadcom/Symantec — Strider Cyberespionage Group Turns Eye Sauron Targets (report)
- Kaspersky — 75533 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Remsec Strider (report)
- artemonsecurity.blogspot.com — Remsec Driver Analysis (report)
- artemonsecurity.blogspot.com — Remsec Driver Analysis Part 2 (report)
- Broadcom/Symantec — Symantec Remsec Iocs (report)
- artemonsecurity.blogspot.com — Remsec Driver Analysis Part 3 (report)
- MITRE ATT&CK — S0125 (report)