Fileless Remcos RAT Malware

A New RAT: Remcos RAT Malware

Cybercriminals are now leveraging an Excel vulnerability (CVE-2017-0199) in a recent phishing campaign to deliver a fileless variant of Remcos RAT. This malware allows attackers to remotely control infected systems and steal sensitive data by deploying the RAT directly into memory, bypassing traditional detection methods.

Threat actors have abused Remcos to collect sensitive information from victims and remotely control their computers to perform further malicious acts. The starting point of the attack is a phishing email that uses purchase order-themed lures to convince recipients to open a Microsoft Excel attachment.

Remcos RAT is equipped to harvest various information from the compromised host, including system metadata, and can execute instructions remotely issued by the attacker through a command-and-control (C2) server. These commands allow the program to harvest files, enumerate and terminate processes, manage system services, edit Windows Registry, execute commands and scripts, capture clipboard content, alter a victim’s desktop wallpaper, enable camera and microphone, download additional payloads, record the screen, and even disable keyboard or mouse input.

CVE-2017-0199 Vulnerability and Exploitation in Phishing Campaigns

The newly discovered zero-day vulnerability (CVE-2017-0199) in Microsoft Office/WordPad is actively exploited in the wild. Almost all Microsoft Office versions are affected by this bug. On April 11, 2017, Microsoft released a security update to fix this vulnerability.

Exploit Mechanism: Attackers send a phishing email with an Excel attachment, leveraging CVE-2017-0199 to deliver malicious code directly into memory. When the user opens the attachment, the vulnerability triggers an embedded script or executable, enabling the malware to bypass traditional file-based detection mechanisms.

Key industries that could be affected:

How LOGON can help you tackle this issue

The rise in sophisticated cyber threats highlights an urgent need for more advanced cybersecurity defenses. Modern phishing campaigns use techniques like exploiting remote code execution vulnerabilities, evading detection with layered obfuscation, and manipulating legitimate platforms such as DocuSign to bypass security measures.

However, more than traditional defenses are required. Organizations need robust cybersecurity solutions to counter these sophisticated attacks.

Content Disarm and Reconstruction (CDR)

Prevent malicious content embedded within seemingly legitimate files from infiltrating corporate networks.

CDR technology sanitizes incoming files, removing potential malware threats while preserving usability. In scenarios like the recent Remcos RAT campaign, where a malicious Excel file initiates an attack, CDR could prevent such files from reaching end-users, blocking an infection before it starts.

File Auditing Solutions

Get essential visibility into file access and modifications across the organization.

With malware increasingly adopting fileless techniques and utilizing legitimate tools like PowerShell, these solutions help detect unusual activity patterns or unauthorized access attempts, often indicators of compromise. Real-time file auditing also supports incident response teams by quickly identifying affected files and endpoints, which is crucial in mitigating the spread of malware within a network.

Anti-Phishing and Zero Trust Solutions

Identify and block deceptive phishing emails before they reach inboxes.

A Zero Trust approach, which enforces strict verification for all network access requests, significantly reduces the risk of unauthorized access. By limiting lateral movement within networks, Zero Trust further mitigates the impact of any successful breach, containing the spread of malware like Remcos RAT.