IOCs by window
0
IOCs tagged #Remcos
6
IOCs tagged #Remcos
36
IOCs tagged #Remcos
1,328
IOCs tagged #Remcos
Counts as of 2026-07-03. Regenerated daily.
About #Remcos
- Type: commercial Remote Access Tool (Remote Control and Surveillance) sold by Breaking Security. Marketed for legitimate remote administration, but pirated and cracked builds dominate the wild and feature heavily in financially-motivated phishing campaigns.
- Abuse pattern: delivered as a second stage from invoice / shipping / DHL phishing emails. Common loaders are Office macro documents, ISO / IMG attachments and AutoIt-compiled droppers. Lat-am, EU and English-speaking SMB targets predominate.
- Detection signals: default config strings (
RemcosClient,watchdog), TCP C2 on non-standard ports (typically 2404 / 2700 / 8080), AutoIt loader signatures, registry persistence underSOFTWARE\Remcos. - References: MITRE ATT&CK S0332 · Malpedia.
Recent IOCs tagged #Remcos
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/remcos.
| Date | Type | Value | Source |
|---|---|---|---|
| domain | |||
| url | |||
| domain | |||
| url | |||
| url | |||
| ip | |||
| sha256 | |||
| domain | |||
| url | |||
| domain |
Related tags
Frequently asked questions
What is Remcos?
Remcos (Remote Control and Surveillance) is a commercial Remote Access Tool sold by Breaking Security. It is marketed for legitimate remote-administration use but pirated and cracked builds are widely abused in financially-motivated phishing campaigns. MITRE ATT&CK tracks it as S0332. Capabilities include keylogging, screen capture, file management, microphone and webcam access.
How is Remcos delivered in real campaigns?
Most commonly as a second stage from phishing emails - invoice, shipping, DHL or banking lures. The first-stage loader is typically a malicious Office macro, an ISO / IMG container or an AutoIt-compiled dropper. Latin American, European and English-speaking SMB users are the most frequently targeted demographics in current campaigns.
How is this list updated?
Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. Remcos-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.
What is the license? Can I use this commercially?
All TweetFeed IOC data, including this Remcos subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.
License
Remcos IOC data: CC0 1.0 Public Domain. No attribution required, no warranty. Source code for the pipeline: github.com/0xDanielLopez/TweetFeed (MIT).