Remcos
MITRE ATT&CK: S0332 View on attack.mitre.org
Aliases: RemcosRAT, Remvio, Socmer, Remcos, Rescoms
- First seen
- 2016-08-01 00:00:00
- Malware type
- rat, keylogger, spyware, screen-capture
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 20532 (16079 malicious)
- Last IoC activity
- 2026-10-18 04:01:11
- Profile updated
- 2026-07-07 15:46:51
Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical technology-and-telecommunications
Context
Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. Remcos has been observed being used in malware campaigns.
Recent IoC activity
16,085 malicious indicators in Maltiverse are attributed to Remcos (S0332). The 20 most recently updated:
Detection coverage
- 4 YARA rules
- 736 Sigma rules
Malware & tools used
- Internal Defacement (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- System Information Discovery (attack-pattern)
- Clipboard Data (attack-pattern)
- Process Injection (attack-pattern)
- Spearphishing Attachment (attack-pattern)
- Python (attack-pattern)
- Proxy (attack-pattern)
- Modify Registry (attack-pattern)
- Asymmetric Cryptography (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- Windows Service (attack-pattern)
- System Checks (attack-pattern)
- Windows Command Shell (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- Bypass User Account Control (attack-pattern)
- Screen Capture (attack-pattern)
- Archive via Utility (attack-pattern)
- Indicator Removal (attack-pattern)
- Hidden Window (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Visual Basic (attack-pattern)
- Malicious File (attack-pattern)
- Dynamic Resolution (attack-pattern)
- Keylogging (attack-pattern)
Used by threat actors
- Operation Spalax (campaign)
- TA2536 (threat-actor)
- Gamaredon Group (threat-actor)
- Gorgon Group (threat-actor)
- APT-C-36 (threat-actor)
- LazyScripter (threat-actor)
Detection rules
- MALPEDIA_Win_Remcos_Auto (yara-rule)
- SIGNATURE_BASE_MAL_Coralwave_Lenovospkvol_Remcosmicdrop (yara-rule)
- SEKOIA_Rat_Win_Remcos (yara-rule)
- EMBEERESEARCH_Win_Remcos_Rat_Unpacked (yara-rule)
Reports & references
- Broadcom/Symantec — Elfin Apt33 Espionage (report)
- researchcenter.paloaltonetworks.com — Unit42 Gorgon Group Slithering Nation State Cybercrime (report)
- research.checkpoint.com — Blind Eagle And Justice For All (report)
- spamhaus.org — Botnet Threat Update January To June 2025 (report)
- info.spamhaus.com — Jul Dec%202024%20Botnet%20Threat%20Update (report)
- spamhaus.org — Botnet Threat Update July To December 2025 (report)
- info.spamhaus.com — Jan Jun%202024%20Botnet%20Threat%20Update (report)
- intrinsec.com — Intrinsec 2025 Threat Report Trouble In The Air (report)
- threatresearch.ext.hp.com — Javascript Malware Dispensing Rats Into The Wild (report)
- threatresearch.ext.hp.com — Hp Wolf Security Threat Insights Report Q3 2021 (report)
- spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
- labs.bitdefender.com — 5 Times More Coronavirus Themed Malware Reports During March (report)
- blackberry.com — Report Old Dogs New Tricks (report)
- ptsecurity.com — Antisandbox Techniques (report)
- intrinsec.com — Tlp Clear From Espionage To Psyops Tracking Operations And Infrastructure Of Uacs In 2025 En 1 (report)
- proofpoint.com — New Whiteshadow Downloader Uses Microsoft Sql Retrieve Malware (report)
- ciphertechsolutions.com — Roboski Global Recovery Automation (report)
- malwarebytes.com — 20221121 Threat Intel Report Final (report)
- securityintelligence.com — Roboski Global Recovery Automation (report)
- Broadcom/Symantec — Elfin Apt33 Espionage (report)
- Kaspersky — 117596 (report)
- CERT-UA — 3931296 (report)
- socprime.com — Remcos Rat Detection Uac 0050 Hackers Launch Phishing Attacks Impersonating The Security Service Of Ukraine (report)
- socprime.com — New Phishing Attack Detection Attributed To The Uac 0050 And Uac 0096 Groups Spreading Remcos Spyware (report)
- CERT-UA — 3804703 (report)