Remcos RAT C2 activity mapped

Remcos, a commercial remote access tool distributed by Breaking-Security and marketed as management software, has become a serious threat in the cybersecurity landscape.

See also: Lazarus' new ScoringMathTea RAT allows remote command execution

It was developed in the mid-2010s and allows attackers to execute remote commands, steal files, record screens, log keystrokes, and collect user credentials via command and control servers using HTTP or HTTPS channels.

Despite being positioned as legitimate software with both a free and paid version, unauthorized copies are actively used for data theft and unauthorized system access.

Malware spreads through email campaigns containing malicious attachments and files hosted on compromised websites.

See also: Hackers exploit vulnerability in Triofox to install RAT

Attackers also use specialized loaders such as GuLoader and Reverse Loader to deliver Remcos as a second-stage payload, allowing them to bypass initial detection systems.

Once installed, the malware establishes persistence and maintains constant communication with its control infrastructure, creating a reliable backdoor for ongoing attacks.

Censys security analysts noted that between October 14 and November 14, 2025 , they consistently monitored over 150 active Remcos command and control servers worldwide.

See also: Phishing: Distribution of PureHVNC RAT via court documents

This combination of command execution, file transfer capabilities, and resilient persistence makes Remcos particularly dangerous for organizations with weak security controls, requiring immediate network monitoring and endpoint detection measures.