Remcos RAT WebRTC Communication

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

Detects suspicious process command lines associated with WebRTC, STUN, TURN, or ICE protocols when initiated by common web browsers (Chrome, Firefox, Opera) and having a parent process identified as 'Remcos'. This behavior could indicate the Remcos RAT attempting to establish peer-to-peer communication or exfiltrate data.