#REMCOSRAT - Twitter Hashtag

about 10 hours ago

Trwa aktywna kampania #RemcosRAT, którą na bieżąco wykrywamy i blokujemy, a tutaj ostrzegamy! Remcos RAT to tzw. trojan zdalnego dostępu (Remote Access Trojan). Przestępcy mogą przejąć kontrolę nad Twoim komputerem, by następnie np. przechwytywać ekran, uzyskiwać dostęp do kamery i mikrofonu czy rejestrować w czasie rzeczywistym wciskane przyciski (np. przy logowaniu do banków czy firmowych aplikacji). Zaczyna się od phishingu i załącznika (zobacz następny post)👇

CERT_OPL's tweet photo. Trwa aktywna kampania #RemcosRAT, którą na bieżąco wykrywamy i blokujemy, a tutaj ostrzegamy!

Remcos RAT to tzw. trojan zdalnego dostępu (Remote Access Trojan). Przestępcy mogą przejąć kontrolę nad Twoim komputerem, by następnie np. przechwytywać ekran, uzyskiwać dostęp do kamery i mikrofonu czy rejestrować w czasie rzeczywistym wciskane przyciski (np. przy logowaniu do banków czy firmowych aplikacji). Zaczyna się od phishingu i załącznika (zobacz następny post)👇

1

6

5

1

757

D3Lab @D3LabIT

7 days ago

🚨 Campagna malware #RemcosRAT in #Italia 📩 “Richiesta di Offerta” Il messaggio contiene un allegato XLS utilizzato per distribuire il malware! 🧬 MD5 0a7fc4b22cc2224494897ff2e755414f 🌐 C2 monjiso[.]v6[.]army cashicash[.]workablegoods[.]com ... 🔥 Attenzione agli allegati!

D3LabIT's tweet photo. 🚨 Campagna malware #RemcosRAT in #Italia
📩 “Richiesta di Offerta”
Il messaggio contiene un allegato XLS utilizzato per distribuire il malware!
🧬 MD5 0a7fc4b22cc2224494897ff2e755414f
🌐 C2
monjiso[.]v6[.]army
cashicash[.]workablegoods[.]com
...

🔥 Attenzione agli allegati! https://t.co/9BGFcN2f7y

0

2

3

0

339

Maharashtra Cyber @MahaCyber1

2 months ago

Beware of Fake GST Debit Note Emails | Remcos RAT Malware Alert #CyberSecurity #CyberAwareness #FakeGST #GSTScam #DebitNoteScam #RemcosRAT #MalwareAlert #CyberCrime #OnlineFraud #EmailScam #PhishingAlert #DataSecurity #DigitalSafety #StayAlert #MaharashtraCyber

MahaCyber1's tweet photo. Beware of Fake GST Debit Note Emails | Remcos RAT Malware Alert
#CyberSecurity #CyberAwareness #FakeGST #GSTScam #DebitNoteScam #RemcosRAT #MalwareAlert #CyberCrime #OnlineFraud #EmailScam #PhishingAlert #DataSecurity #DigitalSafety #StayAlert #MaharashtraCyber https://t.co/QNy4eBB724

0

3

0

3K

Maharashtra Cyber @MahaCyber1

2 months ago

बनावट GST डेबिट नोट ईमेलपासून सावध रहा! #CyberSecurity #CyberCrime #GSTFraud #GSTScam #RemcosRAT #MalwareAlert #CyberAwareness #OnlineFraud #EmailScam #PhishingAlert #DigitalSafety #CyberSafety #StayAlert #1930 #MaharashtraCyber

MahaCyber1's tweet photo. बनावट GST डेबिट नोट ईमेलपासून सावध रहा!
#CyberSecurity #CyberCrime #GSTFraud #GSTScam #RemcosRAT #MalwareAlert #CyberAwareness #OnlineFraud #EmailScam #PhishingAlert #DigitalSafety #CyberSafety #StayAlert #1930 #MaharashtraCyber https://t.co/vXd9SUGutr

0

5

1

0

2K

D3Lab @D3LabIT

2 months ago

🚨 Campagna #RemcosRAT in #Italia Rilevata una campagna #malspam con oggetto "Richiesta di preventivo". IoC - cinnamonthai[.]com/cgi-bins/05.08_8080_64[.]exe - C2: comeforreealz[.]duckdns[.]org - C2: careerlongprofit[.]duckdns[.]org - MD5: c5572f461bcc603de50104ec6c245098

D3LabIT's tweet photo. 🚨 Campagna #RemcosRAT in #Italia

Rilevata una campagna #malspam con oggetto "Richiesta di preventivo".

IoC
- cinnamonthai[.]com/cgi-bins/05.08_8080_64[.]exe
- C2: comeforreealz[.]duckdns[.]org
- C2: careerlongprofit[.]duckdns[.]org
- MD5: c5572f461bcc603de50104ec6c245098 https://t.co/pjE4h9SdCa

0

8

4

0

669

D3Lab @D3LabIT

2 months ago

🚨 Nuova campagna #RemcosRAT rilevata in #italia 📧 Oggetto: Ordine Nr. R-25060 / D(36)-RĪGA 🔑 MD5: a0cea8cab9dffb06bed0ddd29c9b55c0 🌐 C2: tomwim[.]ygto[.]com 🔥 Attenzione agli allegati sospetti!

D3LabIT's tweet photo. 🚨 Nuova campagna #RemcosRAT rilevata in #italia

📧 Oggetto: Ordine Nr. R-25060 / D(36)-RĪGA
🔑 MD5: a0cea8cab9dffb06bed0ddd29c9b55c0
🌐 C2: tomwim[.]ygto[.]com

🔥 Attenzione agli allegati sospetti! https://t.co/jQOdwbb3DS

0

4

2

0

739

JAMESWT @JAMESWT_WT

3 months ago

"UniCredit, disposizione di bonifico in entrata" from server8-node2.iworx-host[.]com 5.56.37[.]133 #spam mail spread #RemCosRat c2 37.27.30.]5:2404 Samples👇 https://t.co/9qAhEcKGDA cc @UniCredit_IT

JAMESWT_WT's tweet photo. "UniCredit, disposizione di bonifico in entrata"
from server8-node2.iworx-host[.]com 5.56.37[.]133
#spam mail spread #RemCosRat
c2 37.27.30.]5:2404

Samples👇
https://t.co/9qAhEcKGDA

cc @UniCredit_IT https://t.co/BO4FOlMGRs

2

7

3

2

1K

D3Lab @D3LabIT

3 months ago

🚨 Nuova campagna #malware Remcos RAT Oggetto "Riferimento del pagamento n.: TT/810-363295460 Importo: EUR 26.480,25". 📎 L'email allega un archivio .ARJ contenente uno script .VBS 🔎 IoC • MD5: 088e5f818e976e85df25b84affb59c20 • C2: magicmike26[.]myddns[.]me #RemcosRAT

D3LabIT's tweet photo. 🚨 Nuova campagna #malware Remcos RAT

Oggetto "Riferimento del pagamento n.: TT/810-363295460 Importo: EUR 26.480,25".

📎 L'email allega un archivio .ARJ contenente uno script .VBS
🔎 IoC
• MD5: 088e5f818e976e85df25b84affb59c20
• C2: magicmike26[.]myddns[.]me

#RemcosRAT https://t.co/pUcX00Uq54

1

5

1

909

Daily CyberSecurity @Daily_CyberSec

4 months ago

A steganographic loader hides Remcos RAT inside a bitmap and runs it in memory. K7 ties the fileless campaign to India via fake GST lures. #RemcosRAT #Steganography #Malware #Phishing #InfoStealer https://t.co/yGS7bc9hqO

Daily_CyberSec's tweet photo. A steganographic loader hides Remcos RAT inside a bitmap and runs it in memory. K7 ties the fileless campaign to India via fake GST lures.

#RemcosRAT #Steganography #Malware #Phishing #InfoStealer
https://t.co/yGS7bc9hqO https://t.co/jSKC4o5i0v

0

3

1

2

633

Daily CyberSecurity @Daily_CyberSec

4 months ago

G Data uncovers a new Remcos RAT variant using DonutLoader shellcode and trusted LOLBins to bypass Windows security filters. #Cybersecurity #Malware #RemcosRAT #DonutLoader #ThreatIntel #Infosec #LOLBins https://t.co/5V4DV0Dptq

Daily_CyberSec's tweet photo. G Data uncovers a new Remcos RAT variant using DonutLoader shellcode and trusted LOLBins to bypass Windows security filters.

#Cybersecurity #Malware #RemcosRAT #DonutLoader #ThreatIntel #Infosec #LOLBins
https://t.co/5V4DV0Dptq https://t.co/hyTXSv4Fkr

0

2

1

2

475

Daily CyberSecurity @Daily_CyberSec

4 months ago

Read our BlackToad malware analysis. Learn how this Nigerian cybercrime group uses network disconnection to blind EDR tools and drop the Remcos RAT. #BlackToad #MalwareAnalysis #Cybersecurity #RemcosRAT #ThreatIntel #InfoSec https://t.co/rA6aJZwPV4

Daily_CyberSec's tweet photo. Read our BlackToad malware analysis. Learn how this Nigerian cybercrime group uses network disconnection to blind EDR tools and drop the Remcos RAT.

#BlackToad #MalwareAnalysis #Cybersecurity #RemcosRAT #ThreatIntel #InfoSec
https://t.co/rA6aJZwPV4 https://t.co/h1pZ2Q4Ydm

0

7

2

385

JAMESWT @JAMESWT_WT

5 months ago

"ReÑ Re: Order Ref: SCAN-1107_L0904-5265Z500." spread #remcosrat ⛔️Url https://exportadorasurtrade-cl.]com/secure/login code E68FC66E003E4480955B2393BFA45SE2 ⛔️C2 89.40.206.]73:2404 www.klrail.]com Samples https://t.co/pPiRSRzTLr AnyRun https://t.co/VwtoFnKZF6

JAMESWT_WT's tweet photo. "ReÑ Re: Order Ref: SCAN-1107_L0904-5265Z500."
spread #remcosrat

⛔️Url
https://exportadorasurtrade-cl.]com/secure/login
code
E68FC66E003E4480955B2393BFA45SE2

⛔️C2
89.40.206.]73:2404
www.klrail.]com

Samples
https://t.co/pPiRSRzTLr
AnyRun
https://t.co/VwtoFnKZF6 https://t.co/FIY97XAomN

0

10

2

4

788

Daily CyberSecurity @Daily_CyberSec

5 months ago

Zscaler ThreatLabz exposes DeepSeek-Claw, a malicious AI skill targeting the OpenClaw framework to deploy GhostLoader and Remcos RAT. Secure your agents now! #AISecurity #OpenClaw #CyberSecurity #InfoSec #DeepSeekClaw #GhostLoader #RemcosRAT https://t.co/461yy3iJRJ

Daily_CyberSec's tweet photo. Zscaler ThreatLabz exposes DeepSeek-Claw, a malicious AI skill targeting the OpenClaw framework to deploy GhostLoader and Remcos RAT. Secure your agents now!

#AISecurity #OpenClaw #CyberSecurity #InfoSec #DeepSeekClaw #GhostLoader #RemcosRAT
https://t.co/461yy3iJRJ https://t.co/akj3iQagRD

0

6

4

0

390

Daily CyberSecurity @Daily_CyberSec

6 months ago

Researchers unmask a fileless Remcos RAT campaign using obfuscated JS and LOLBins to hijack systems in-memory. See the technical breakdown from Lat61. #RemcosRAT #FilelessMalware #CyberSecurity #InfoSec #ThreatIntel #Lat61 #MalwareAlert #WindowsSecurity https://t.co/9lQrsRQuHQ

0

32

10

8

2K

Hackread.com @HackRead

7 months ago

New XWorm 7.1 and Remcos RAT campaigns are abusing trusted #Windows utilities and memory-based execution to evade detection. The campaign also exploits a #WinRAR vulnerability to gain initial access. Read: https://t.co/RB1PbLxviD #CyberSecurity #Malware #XWorm #RemcosRAT

0

8

1

803

Daily CyberSecurity @Daily_CyberSec

7 months ago

Trellix uncovers a stealthy, fileless Remcos RAT campaign utilizing process hollowing to execute entirely in memory and evade traditional security. #RemcosRAT #FilelessMalware #Trellix #CyberSecurity #InfoSec #ProcessHollowing #ThreatIntel #Malware https://t.co/vBZ61KN0r7

Daily_CyberSec's tweet photo. Trellix uncovers a stealthy, fileless Remcos RAT campaign utilizing process hollowing to execute entirely in memory and evade traditional security.

#RemcosRAT #FilelessMalware #Trellix #CyberSecurity #InfoSec #ProcessHollowing #ThreatIntel #Malware
https://t.co/vBZ61KN0r7 https://t.co/6imNKilYi4

0

34

8

7

1K

SANS.edu Internet Storm Center

@sans_isc

7 months ago

ISC diary: #SmartApeSG campaign uses #ClickFix page to push #Remcos #RAT (#RemcosRAT) https://t.co/ycO7RiSPfy

0

9

6

3

3K

. @__0XYC__

7 months ago

DHL Receipt_57216218402.rar fedbac4768636be461c284e60f1a44cf stage 2 > hXXp://203.202.232[.]37/img/hiii/cossro[.]hta a33a8261eb76c717275012f0b04577d1 #APT #RemcosRAT https://t.co/q7mWAnKcfU

0

7

4

5

2K

blinkz

@BlinkzSec

8 months ago

@500mk500 #remcosRAT its the a.exe I'll make a separate post for the bat file. sha256:4f0c95a1885411100649bf8150c2f189dc0941ac569b801b3765d1ca64b760dc hxxp://186.169.75.221/ https://t.co/yAa5XSSbnD