Remcos RAT Technical Analysis and Adversary Tradecraft

Remcos (Remote Control and Surveillance) is a prevalent commodity Remote Access Trojan (RAT) first introduced in 2016. While marketed as a legitimate administration tool by Breaking Security, it is heavily utilized by threat actors, including APT33, The Gorgon Group, and UAC-0050, for espionage and cybercrime. The malware provides operators with near-complete control over infected Windows systems, facilitating command execution, silent activity recording, and sensitive data exfiltration.

The attack chain typically involves multi-stage delivery (e.g., via CVE-2017-0199 or steganographic loaders) followed by defense evasion through process injection and masquerading. Remcos leverages a COM-based UAC bypass to escalate privileges and maintains persistence via multiple registry Run keys and a watchdog process that monitors and restarts the malware if terminated. Its surveillance suite includes keylogging, audio/webcam capture, and browser data wiping to facilitate credential harvesting.

Remcos remains under active development, with version 4.9.4 released in early 2024. Its continued use across global sectors—including aerospace, government, and financial services—highlights its status as a high-impact threat that requires robust endpoint monitoring and behavioral detection strategies.