Cybercriminals are getting better at hiding their tracks, and a recently uncovered Remcos RAT campaign is proof of that. This attack does not rely on a single malicious file dropped onto a system. <\/p>\n
Instead, it uses a carefully built, multi-stage chain that starts with a simple phishing email and ends with a full, in-memory system compromise \u2014 leaving almost no trace on the disk.<\/a><\/p>\n Remcos RAT, short for Remote Control and Surveillance, has been a known threat for years. Attackers use it to steal data, log keystrokes, and remotely control infected machines. <\/p>\n What makes this latest campaign stand out is how it reaches the victim. Rather than relying on easy-to-spot delivery methods, this operation strings together multiple layers of obfuscation, trusted Windows tools, and a live C2 server to deliver its payload with precision.<\/a><\/p>\n Analysts and researchers at Point Wild\u2019s LAT61 Threat Intelligence Team identified this campaign<\/a> after examining a malicious email file (.eml). <\/p>\n They found that the attack begins with a ZIP attachment named \u201cMV MERKET COOPER SPECIFICATION.zip,\u201d designed to look like a routine business document. <\/p>\n Once opened, it releases an obfuscated JavaScript file that quietly sets the attack in motion, all without triggering standard security alerts.<\/a><\/p>\n The campaign\u2019s impact is serious. Once fully deployed, Remcos establishes a persistent connection to a remote C2 server at 192[.]3[.]27[.]141:8087, actively sending and receiving data. <\/p>\n Evidence of data collection was confirmed through the creation of a log file at\u00a0 What makes this threat particularly difficult to stop is its ability to hide inside the very tools Windows users trust every day. <\/p>\n By abusing legitimate system binaries and running entirely in memory, the attackers managed to bypass many traditional security defenses. This kind of attack shows how far threat actors have come in designing operations that blend into normal system activity.<\/a><\/p>\n The infection begins the moment a user opens the phishing email and extracts the ZIP file. <\/p>\n Inside the archive is a JavaScript file \u2014 MV MERKET COOPER SPECIFICATION.js \u2014 that is heavily obfuscated using string-mapping functions and encoded arrays to hide its true purpose. <\/p>\n Upon execution via Windows Script Host, the script creates ActiveX objects to handle HTTP communication, command execution, and file operations, and then contacts almacensantangel[.]com to download a remote PowerShell script<\/a> called ENCRYPT.Ps1.<\/p>\n The PowerShell loader applies multiple layers of obfuscation to rebuild the payload in memory. <\/p>\n The data is stored as a large Base64-encoded string inside the\u00a0 A rotational XOR function then decrypts the data using a shifting key mechanism, and the\u00a0 The\u00a0 The decrypted script reveals a .NET assembly called ALTERNATE.dll, loaded directly into memory through .NET Reflection APIs with no file written to disk.<\/p>\n A secondary payload, Cqeqpvzeia.exe, is embedded as a raw byte array starting with the \u201cMZ\u201d PE signature\u00a0and injected into aspnet_compiler.exe \u2014 a legitimate Microsoft .NET tool \u2014 through a Living-off-the-Land technique. <\/p>\n This abused process handles all outbound C2 communication, making malicious traffic appear as routine system activity.<\/a><\/p>\n Organizations should monitor PowerShell execution<\/a> events, especially those involving Base64-encoded commands and execution policy bypass flags. <\/p>\n Outbound connections from system utilities like aspnet_compiler.exe to unknown external hosts should be treated as suspicious. <\/p>\n Security teams should also watch for the file\u00a0 Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post Remcos RAT Infection Chain Hides Behind Obfuscated Scripts and Trusted Windows Binaries<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nC:ProgramDataremcoslogs.dat<\/code>, which stores captured keystrokes and other system information. This indicates the malware was actively staging data for exfiltration<\/a>.<\/a><\/p>\nMulti-Stage Infection Mechanism: From Phishing to In-Memory Execution<\/strong><\/h2>\n
![\"Attack](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhEfNhmaU3xBjfEMyZMjWQW9A77OKAHdLl8AzH9uSFLaH-blyMeVT4o4fgji0MoxEsY8auytDxzHr1Ge46Oz3fByN81iro8j3rza1T3zDQeY8w49P70UvyQD64DxkliZ3Z3D7GqrDZQ_SNJVCSLmObRxB0Lz8HHl9c4mEY2J1vdI1ZtlWKg5glxFlsZ_HA\/s16000\/Attack%2520Flow%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
![\"MV](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhyXMq0pAC2kuqWGnnaYcw9Z2zVBCe7f17wUbJP3MJNq7lZuLRcFKcdlwFsA0X0fi-dZBenKooDqkb5OgptJYROU_rz92aJ4DiWQnXZu1KdJZDkOD9G34VGFnMasYJx9qCuocjOQsxQ3KxobQmRTgypeFwCQ2uqPZPyskwOJxZn4IYJDKCPjDH5MbswrQI\/s16000\/MV%2520MERKET%2520COOPER%2520SPECIFICATION.js%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
![\"Email](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg1C67TAuPmPfbgVFABeq9RhnR5o86oIc2t_VKxR2u8LZe1ZOj51WdVdULMEw8cKisCg4T6zRhcc2np0M6mJ3HbLz55VhYLybTxXmDTfSYtYXg2sy0XhYJKspMir-DRnpQUmimyfezXkHccKd7wvPD-NNCatzYns8q71rIH1Q2qMlFZRe19gw2I_sox9B0\/s16000\/Email%2520Attachment%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
![\"Encrypted](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh4hyphenhyphenLgaxkmqf-QebhdHl2cUuz2XBXC-4uBkPXpfg4uyaDBUMXUrMX0uktDJWGt8VONs_FV8en9aL5r6tegcw5iiaOztKpTX8BtmjXFQ7kuaky5miy1bS72b87Mq5FrUSdSobMFn0gx8-4dqnHjNbtyL1Q57nIpwoIVwm8uhIOa6gIIZb726kJiRoYrJ_0\/s16000\/Encrypted%2520Data%2520in%2520ps1%2520file%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
$securecontainer<\/code>\u00a0variable, which the\u00a0$base64reconstruction<\/code>\u00a0function converts into raw byte arrays. <\/p>\n![\"Base64](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWyPzzw1e4hqI78g-jvaxbRpcDMKSTieqV44Db2VAGPehS6I35WWf0tRDnGFcncukEUVsEkEEc1x0Eiw3z4ijKTBuQRD2bNDp4xHBZyvwtLBzo0jWKAohyphenhyphenx-iCDfUmKUyit091onUKrFiQi3YlMW6U5pUy_XF3LzCyXEUmao_aSN8Fpp_shwzfpLQbORA\/s16000\/Base64%2520Reconstruction%2520Module%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
$masterdecoder<\/code>\u00a0function brings the full decryption together. <\/p>\n$executionhandler<\/code>\u00a0finally runs the recovered script through Invoke-Expression with built-in fallback methods.<\/em><\/a><\/p>\nC:ProgramDataremcoslogs.dat<\/code>\u00a0as a key indicator of compromise. Blocking known malicious URLs<\/a>, hashes, and C2 infrastructure from the IOC table remains a critical step in containing this threat early.<\/p>\n