Cybersecurity researchers have uncovered a highly sophisticated malware campaign that delivers the notorious Remcos Remote Access Trojan (RAT). Remcos is a widespread threat known for providing attackers with backdoor access to infected systems and collecting sensitive information.
This newly analyzed attack chain highlights a significant shift in threat actor tradecraft, moving away from traditional disk-based malware toward fileless, in-memory execution.
By chaining together socially engineered phishing emails, heavily obfuscated scripts, and trusted Windows binaries, attackers are successfully bypassing conventional security defenses to achieve total system compromise.
Deconstructing The Multi-Stage Infection
The intrusion begins with a classic social engineering tactic: a targeted phishing email containing a malicious ZIP archive.
Named to appear as a legitimate business document, like “MV MERKET COOPER SPECIFICATION.zip,” the attachment tricks unsuspecting users into executing its contents.
Inside this archive lies a heavily obfuscated JavaScript file acting as a dropper. To evade static analysis, the attackers conceal their true intentions using encoded arrays and string-mapping functions.
Once executed, the JavaScript relies on the Windows Script Host to create objects for command execution and HTTP communication.
It silently connects to a remote server to download a malicious PowerShell script, bypassing execution policies to run it unrestrictedly.
Evasion, Command-and-Control, and Exfiltration
To further mask its malicious activities, the attack leverages a Living-off-the-Land (LotL) strategy. Instead of running a standalone executable, the malware injects its code into a trusted Microsoft .NET utility, aspnet_compiler.exe.
Living-off-the-Land Binaries (LOLBins) are particularly dangerous because security teams generally trust them. By hiding within this legitimate system process, the malware bypasses process-based execution controls and application allowlisting.
Within this proxy process, the malware unpacks a secondary Portable Executable (PE) payload, identified as Cqeqpvzeia.exe.
Network analysis reveals that the compromised aspnet_compiler.exe process continuously communicates with a remote Command-and-Control (C2) server.
This persistent TCP stream allows the attackers to issue commands and deploy additional packed binaries directly to the infected host.
Post-exploitation activities focus heavily on surveillance and data theft. The Remcos RAT actively monitors user activity, logging keystrokes and system data into a hidden file located at C:\ProgramData\remcos\logs.dat.
According to Point Wild research, because this attack relies heavily on fileless execution and trusted system tools, traditional signature-based defenses often fail to detect it.
Security platforms like UltraAV are required to identify the early stages of this attack chain, specifically by catching the obfuscated script files and blocking known malicious network infrastructure before the final memory-resident payload can execute.
This comprehensive research underscores the urgent need for behavioral monitoring to combat the evolving complexity of modern RAT deployments.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
