REMCOS Remote Control & Surveillance Software

How Remcos Works

Remcos is distributed via email phishing campaigns that attempt to trick targets into opening malicious Microsoft Office documents using social engineering tactics such as COVID-related spam. If a target opens the attached document and enables macros, Remcos’s stager can bypass Microsoft Windows’ User Account Control by hijacking the Windows Registry to execute the primary Remcos payload with high-level system privileges. To maintain persistent access to a compromised system, Remcos adds a Windows Registry AutoStart key to execute the malware once the infected system is restarted.

Remcos is a Windows-based application written in both C++ and Delphi. It is capable of multithreaded remote scripting for high-performance exploitation. It has multiple remote access options, such as command shell access, service manager interface, SOCKS5 remote proxy, and an easy-to-use administrator GUI.

Remcos uses a custom TCP-based protocol to establish encrypted connections and keepalive to maintain its command-and-control (C2) connection over unstable networks. These efficient and robust tools make Remcos the malware of choice for maintaining zombie botnets and proxying internet traffic on compromised hosts.