Remcos RAT Watchdog Relaunch and Self-Resurrection Loop

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Remcos RAT watchdog activity characterized by process injection into system binaries (svchost.exe, rmclient.exe, fsutil.exe) to relaunch the main payload from non-standard directories (AppData, Temp, ProgramData), or a self-resurrection loop where the malware spawns a child process with an identical file path to maintain execution after termination.