{
  "family": "rescoms",
  "sample_count": 26,
  "category": "trojan",
  "description": "Backdoor:Win32/Rescoms (also commonly known as Remcos RAT) is a highly capable, commercially available Remote Access Trojan marketed as legitimate remote administration software, but heavily utilized by cybercriminal syndicates and APT groups for espionage, data theft, and lateral movement.<br><br><b>Understanding Rescoms (Remcos RAT)</b><br>To the victim, Rescoms operates completely invisibly. For threat intelligence analysts, Rescoms is a formidable Initial Access Broker (IAB) and espionage tool. Because the core software is commercially developed and regularly updated by its creators (BreakingSecurity), it boasts a highly stable, feature-rich C++ codebase that easily bypasses many legacy AV solutions. Attackers simply purchase a license, pack the binary in a crypter, and deploy it maliciously.<br><br><b>Execution and Evasion Strategies</b><br>Rescoms is typically delivered via spearphishing campaigns containing weaponized Office documents or embedded in malicious ZIP/ISO files. Upon execution, the malware establishes persistence by creating a hidden scheduled task (`T1053.005`) or modifying the Registry Run keys. It is infamous for its aggressive process injection (`T1055`), often hollowing out legitimate processes like `vbc.exe` (Visual Basic Compiler) or `RegAsm.exe` to execute its core payload in memory. It provides the attacker with full C2 capabilities: live remote desktop (VNC), a hidden command shell, a highly effective keylogger (`T1056.001`), and microphone/webcam recording (`T1123`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and severe data exfiltration. EDR platforms must alert on the process hollowing of native Windows utilities. Network logs will reveal encrypted TCP traffic communicating with a remote C2 server, often masked behind dynamic DNS providers. The presence of hidden keylog files (often saved as `.dat` files in `%AppData%`) is a strong IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1053.005",
    "T1056.001",
    "T1105",
    "T1123",
    "T1055.012"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1123",
      "name": "Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session (VNC/Shell).",
    "Capture a full forensic memory image of the machine to extract the decrypted Remcos payload and its C2 configuration (often stored in the resource section).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Rescoms persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}