{
  "family": "rescoms",
  "sample_count": 26,
  "category": "rat",
  "description": "Rescoms (also documented across threat research repositories under signatures including Backdoor:Win32/Rescoms, Trojan:Win32/Remcos, and widely known as Remcos RAT by Breaking Security) is a notorious commercial Remote Access Trojan (RAT) actively weaponized in cyber espionage and cybercrime operations since 2016. Originally marketed as legitimate remote administration software, Remcos is extensively abused by sophisticated threat actors, cybercrime rings, and state-sponsored APTs. Remcos provides comprehensive surveillance capabilities, including live audio/video recording, keylogging, clipboard hijacking, credential theft from browsers and email clients, arbitrary file transfer, and reverse SOCKS proxy routing. The malware bypasses User Account Control (UAC), injects malicious threads into trusted system processes (svchost.exe, explorer.exe), and establishes encrypted TLS-wrapped command-and-control communication channels.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Rescoms",
    "Trojan:Win32/Remcos",
    "Backdoor.Remcos",
    "Win32/Remcos",
    "Remcos RAT",
    "Backdoor:Win32/Remcos.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Rescoms (Remcos RAT)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rescoms is an evasive remote access trojan (Remcos RAT) providing complete interactive control, webcam/audio surveillance, and keylogging."
      }
    },
    {
      "@type": "Question",
      "name": "How is Rescoms distributed by cyber threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is widely distributed via spear-phishing emails containing malicious office documents (CVE-2017-11882) or ISO/ZIP archives."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance modules are built into Rescoms?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It features webcam surveillance, microphone recording, real-time screen capture, browser password theft, and keystroke logging."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rescoms evade detection and maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects code into svchost.exe or explorer.exe via process hollowing, bypasses UAC, and creates registry Run keys or scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can enterprise security teams detect Rescoms?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy behavioral EDR to detect process hollowing into svchost.exe, monitor for unauthorized TLS C2 traffic on non-standard ports, and enforce MFA."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1090",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spear-Phishing Emails with Malicious Attachments",
    "Office Exploits (CVE-2017-11882)",
    "Malicious ISO and ZIP Archive Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Remote Interactive Desktop Screen Capture",
    "Microphone Audio & Webcam Surveillance",
    "Keystroke Logging & Clipboard Scraping",
    "Browser & Email Credential Theft",
    "Reverse SOCKS5 Proxy Pivoting"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C++)",
      "Encrypted Resource Configuration"
    ],
    "network_signatures": [
      "TLS-encrypted TCP communication on non-standard ports (such as 2404, 3030, 8080) carrying proprietary binary telemetry",
      "Periodic keepalive heartbeat beacons with system hardware metrics and foreground window title"
    ],
    "evasion_techniques": [
      "Process hollowing into svchost.exe, explorer.exe, or RegAsm.exe to mask network traffic",
      "Bypassing User Account Control (UAC) via Event Viewer and FODHelper registry hijacking"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59a7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5",
      "6ab8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Remcos",
      "HKCU\\Software\\Remcos"
    ],
    "file_paths": [
      "%AppData%\\Remcos\\remcos.exe",
      "%Temp%\\remcos_capture.tmp",
      "%AppData%\\remcos_logs.dat"
    ]
  },
  "defensive_measures": [
    "Deploy behavioral EDR to detect process injection and memory tampering targeting svchost.exe and explorer.exe",
    "Inspect perimeter firewalls for unauthorized encrypted outbound TCP connections on non-standard ports",
    "Block incoming email attachments containing archive files (.iso, .vhd, .zip) from untrusted external senders"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Rescoms",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Rescoms"
    },
    {
      "name": "CISA Advisory - Top Malware Strains: Remcos RAT",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
    }
  ],
  "lineage": {
    "derived_from": [
      "Breaking Security Remcos Framework"
    ],
    "variants": [
      "Backdoor:Win32/Rescoms.A",
      "Trojan:Win32/Remcos.B"
    ]
  },
  "motivation": "Cyber Espionage, Credential Theft & Unauthorized Remote Access",
  "sample_hashes": []
}