S0332: Remcos

S0332: Remcos describes [Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been observed being used in malware campaigns.(Citation: Riskiq Remcos Jan 2018)(Citation: Talos Remcos Aug 2018)

Executive priority

S0332: Remcos is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0332: Remcos by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0332: Remcos appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Remcos

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. Remcos has been observed being used in malware campaigns.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques38 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1491.001	Internal DefacementSub-technique	Remcos has the ability to modify the desktop wallpaper.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Remcos can add itself to the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.[3]
Enterprise	T1082	System Information Discovery	Remcos can collect the OS version and process architecture of compromised hosts.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1115	Clipboard Data	Remcos steals and modifies data from the clipboard.[1]CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1055	Process Injection	Remcos has a command to hide itself by injecting into another process.[3]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	Remcos has been spread through emails containing malicious documents.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1059.006	PythonSub-technique	Remcos uses Python scripts.[1]
Enterprise	T1090	Proxy	Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.[1]CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1112	Modify Registry	Remcos has full control of the Registry, including the ability to modify it.[1]CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1573.002	Asymmetric CryptographySub-technique	Remcos can use TLS to encrypt C2 communication.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1027	Obfuscated Files or Information	Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.[2] Remcos can also employ control flow flattening to hinder analysis.CitationCheck Point Blind Eagle MAR 2025
Enterprise	T1543.003	Windows ServiceSub-technique	Remcos can terminate, suspend, and resume a process by PID.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1497.001	System ChecksSub-technique	Remcos searches for Sandboxie and VMware on the system.[2]
Enterprise	T1059.003	Windows Command ShellSub-technique	Remcos can launch a remote command line to execute commands on the victim’s machine.[3]CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Remcos can use string encryption to hinder analysis.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1548.002	Bypass User Account ControlSub-technique	Remcos has a command for UAC bypassing.[3]
Enterprise	T1113	Screen Capture	Remcos takes automated screenshots of the infected machine.[1]CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1560.001	Archive via UtilitySub-technique	Remcos can zip files and folders for upload.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1070	Indicator Removal	Remcos can clean saved cookies and logins from the web browser.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1564.003	Hidden WindowSub-technique	Remcos can set `ProcessWindowStyle.Hidden` to hide windows.CitationCheck Point Blind Eagle MAR 2025
Enterprise	T1105	Ingress Tool Transfer	Remcos can upload and download files to and from the victim’s machine.[1]CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1059.005	Visual BasicSub-technique	Remcos can execute VBS remotely.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1204.002	Malicious FileSub-technique	Remcos has been executed by luring victims into opening malicious email attachments including Excel files.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1568	Dynamic Resolution	Remcos has used dynamic DNS domains in C2 communications.CitationCheck Point Blind Eagle MAR 2025
Enterprise	T1056.001	KeyloggingSub-technique	Remcos has a command for keylogging.[3][2]
Enterprise	T1125	Video Capture	Remcos can access a system’s webcam and take pictures.[3]
Enterprise	T1012	Query Registry	Remcos can obtain Registry data from targeted systems.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1564	Hide Artifacts	Remcos can modify file attributes to hide the file.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1083	File and Directory Discovery	Remcos can search for files on the infected machine.[1]CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1123	Audio Capture	Remcos can capture data from the system’s microphone.[3]CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1070.004	File DeletionSub-technique	Remcos can delete files and folders from victim machines.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1057	Process Discovery	Remcos can discover running processes on compromised machines.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1614	System Location Discovery	Remcos can identify the location of targeted devices.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1010	Application Window Discovery	Remcos can list all windows on victim systems.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1529	System Shutdown/Reboot	Remcos can shutdown and restart remote devices.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1033	System Owner/User Discovery	Remcos can enumerate the username on targeted hosts.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1059.007	JavaScriptSub-technique	Remcos has the ability to execute JavaScript remotely.CitationFortinet Remcos Campaign NOV 2024
Enterprise	T1132.001	Standard EncodingSub-technique	Remcos can serialize collected data with Protobuf.CitationCheck Point Blind Eagle MAR 2025

Associated objects

Groups, software, and campaigns

G0140: LazyScripter

LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.[1]

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

G0099: APT-C-36

APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]

G0078: Gorgon Group

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]

C0005: Operation Spalax

Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The Operation Spalax threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to APT-C-36, however identified enough differences to report this as separate, unattributed activity.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.4
Created: Jan 29, 2019, 18:55 UTC (UTC+00:00)
Modified: Apr 23, 2026, 03:33 UTC (UTC+00:00)
Raw hash: 5a3832e1272fdff1...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.4	Apr 23, 2026, 03:33 UTC (UTC+00:00)	Current bundle	`5a3832e1272f…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.4	Apr 23, 2026, 03:33 UTC (UTC+00:00)	Older bundle	`5a3832e1272f…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.4	Apr 23, 2026, 03:33 UTC (UTC+00:00)	Older bundle	`5a3832e1272f…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Riskiq Remcos Jan 2018
Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.
Open source URL
[2]
Talos Remcos Aug 2018
Brumaghin, E., Unterbrink, H. (2018, August 22). Picking Apart Remcos Botnet-In-A-Box. Retrieved November 6, 2018.
Open source URL
[3]
Fortinet Remcos Feb 2017
Bacurio, F., Salvio, J. (2017, February 14). REMCOS: A New RAT In The Wild. Retrieved November 6, 2018.
Open source URL
[4]
Remcos
(Citation: Riskiq Remcos Jan 2018)(Citation: Fortinet Remcos Feb 2017)(Citation: Talos Remcos Aug 2018)
[5]
mitre-attackS0332
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use