Tax Phishing - Remcos RAT Extracted from Tax ISO (T1566.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Correlates the user mounting a tax-themed ISO archive followed by the execution of a binary establishing a Remcos RAT C2 connection.