Loading malware…
RemoteCMD is a custom Windows remote execution utility associated with APT3. It operates similarly to PsExec and is used to execute commands on remote systems, supporting remote file operations, service operations, and scheduled-task creation. Its documented tradecraft includes creating a new service on a remote host or creating a scheduled task on a remote host to run commands, making it useful for lateral movement and post-compromise remote administration within victim environments. RemoteCMD has been referenced alongside other APT3 tooling used in espionage operations attributed to a China-linked threat actor that historically targeted sectors including aerospace and defense, construction and engineering, high technology, telecommunications, transportation, and later political organizations in Hong Kong. The available evidence supports its role as an operator-controlled remote execution tool for Windows environments rather than as a self-propagating or standalone persistence-focused malware family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
S0166 RemoteCMD [4] Ingress Tool Transfer, Scheduled Task/Job: Scheduled Task, System Services: Service Execution
7 distinct techniques documented for this family, organized by ATT&CK tactic.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
"Anchor can create and execute services to load its payload"; "APT32's backdoor has used Windows services as a way to execute its malicious payload"; "Ragnar Locker has used sc.exe to execute a service that it creates"; "Shamoon creates a new service named 'ntssrv' to execute the payload"
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.
"PsExec ... can be used to execute binaries on remote systems using a temporary Windows service"; "RemoteCMD can execute commands remotely by creating a new service on the remote system"; "Winexe installs a service on the remote system, executes the command, then uninstalls the service"
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor/remote command tool that executes commands remotely by creating scheduled tasks.
Remote administration malware that executes commands remotely via scheduled tasks.
Remote command execution tool used for transferring tools, scheduled task persistence, and service-based execution.
Remote execution tool/malware that runs commands on remote systems by creating a Windows service.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.