Threat Research

Remcos RAT, a sophisticated Remote Access Trojan originally marketed as a legitimate tool, is now widely abused for espionage, credential theft, and system control. Created by Breaking Security, it has been adopted by APT groups and cybercriminals for malicious purposes. Recent campaigns used stealthy, fileless PowerShell loaders to deploy Remcos entirely in memory....

In December 2024, we identified a multi-stage attack chain used to deliver malware such as Agent Tesla variants, Remcos RAT, and XLoader. Attackers are increasingly adopting layered delivery tactics to bypass detection tools and traditional sandboxes. The phishing campaign we examined disguised itself as an order release request, delivering a malicious attachment....