Remcos RAT UAC Bypass via ICMLuaUtil CMSTPLUA COM Interface

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspicious behavior associated with Remcos RAT, including UAC bypass techniques using ICMLuaUtil, process injection into system binaries, and persistence mechanism creation in the Windows registry.