When a user opens the attachment, the file exploits a vulnerability in Microsoft Office’s Equation Editor, CVE-2017-11882. The attached file is named SUCT220002.xlsx. In this campaign, the threat actor(s) send messages with a variety of different subjects, including Re: Ukraine war || Order SUCT220002. The capabilities of Remcos include remotely controlling infected computers, logging keystrokes, and taking screenshots. Although Remcos is marketed as a legitimate remote administration tool, it is frequently abused by threat actors and used for malicious purposes.īreaking Security actively maintains and updates Remcos, with the latest update released on 10 February.

3 One of the versions offered is free and has a limited number of features, and the other version is paid and starts at 58 Euros. Customer impactĪ German company called Breaking Security has been offering Remcos since 2016. Some of them distribute donation or cryptocurrency scams others distribute malware, such as Remcos. We observed multiple Ukraine-related malspam campaigns within the first week after the invasion. Infoblox has previously reported on malspam campaigns distributing Remcos. xlsx file that downloads the Remcos remote access trojan (RAT). This malspam campaign was attempting to lure users into opening an attached. On 2 and 3 March, Infoblox observed a malspam campaign that used messages related to Russia’s invasion of Ukraine.

Download blek le rat rat for free