Loading story…
A large-scale phishing campaign targeted German companies across multiple industries with spoofed emails impersonating legitimate local businesses and carrying archive attachments that hid executables disguised as PDF or document files. Check Point said the payload installed Remcos, a commercially available remote access trojan that can give attackers full control of infected systems while operating silently in the background.
Once executed, Remcos enabled capabilities including privilege escalation, persistence, process injection, keylogging, screen and audio capture, and password theft. The malware’s command-and-control infrastructure relied on Dynamic DNS services, including No-IP, aligning with MITRE ATT&CK technique T1311, a method that helps operators maintain flexible and evasive C2 endpoints as domains and IP addresses change.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point researchers observed a large-scale phishing campaign in the first week of June 2019 targeting German companies across multiple industries. The emails spoofed legitimate German businesses and used archive attachments with executables disguised as documents to install the Remcos remote access trojan.
Check Point publicly reported the campaign and released technical details on the Remcos malware, its use of Dynamic DNS infrastructure, product detections, and indicators of compromise including file hashes and malicious domains. The report identified domains such as ablegod.hopto[.]org and other DDNS-based infrastructure tied to the operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
Researchers and incident reports show **Remcos RAT** continuing to spread through multiple delivery channels, including business-themed phishing emails, fake cryptocurrency software, and multi-stage script loaders. Trend Micro documented a phishing campaign using an ACE archive attachment and an AutoIt-based loader to install **Remcos Professional 1.7**, while ESET reported a spoofed SafeMoon application that delivered Remcos to cryptocurrency users. SonicWall later identified a newer infection chain using VBScript, batch files, PowerShell, and a .NET loader to deploy Remcos after patching **AMSI** and **ETW** for defense evasion, with observed targeting of European institutions. Technical analysis from Elastic Security Labs found that modern Remcos samples retain extensive remote-access and surveillance functions, including **keylogging, screenshots, audio capture, webcam access, shell command execution, password theft, browser-history collection, persistence, process injection, and UAC bypass**. Elastic recovered most of the malware’s configuration structure and command set, showing that Remcos stores encrypted settings, supports TLS-enabled command-and-control, can masquerade as legitimate processes such as `explorer.exe`, and can clean browser artifacts or uninstall itself on command. The reporting underscores how a tool originally marketed for red teaming has become a widely abused malware family with increasingly evasive delivery chains and mature post-compromise control features.
Aug 14, 2026
Attackers used spoofed Government of India GST refund emails to target Indian businesses and taxpayers, luring recipients into opening a malicious RAR attachment that launched a multi-stage **.NET** infection chain and ultimately deployed **Remcos RAT**. Seqrite reported that the initial executable unpacked successive in-memory loaders hidden in bitmap resources and DLL stages, including **`Windows Health Optimizer Plus.dll`** and **`perfgurd.dll`**, while using reflection, **XOR-based decryption**, and architecture-aware method dispatch to evade analysis and execute the final payload. The campaign established persistence by copying the executable and launching a **PowerShell** script through a **Run** registry key, and it attempted privilege escalation via **`cmstp.exe`**. The final **Remcos RAT** payload enabled remote access, credential theft, surveillance, and delivery of additional malware. Infrastructure tied to the operation included dynamic DNS domains under **`hath.network`** and **`synology.me`**, with command-and-control activity resolving to **`185.242.4.122`** on hosting associated with **M247 Europe SRL**; researchers assessed the activity as likely financially motivated cybercrime but did not attribute it to a known threat actor.
Jul 23, 2026