IOCs by window
0
IOCs tagged #Remcos
0
IOCs tagged #Remcos
0
IOCs tagged #Remcos
289
IOCs tagged #Remcos
Counts as of 2026-11-03. Regenerated daily.
About #Remcos
- Type: Commercial RAT sold by Breaking Security.
- Misuse: Marketed for remote admin. Pirated and cracked builds dominate in the wild.
- Delivery: Second stage from invoice, shipping and DHL phishing emails.
- Common loaders: Office macros, ISO / IMG files, AutoIt droppers.
- Targets: Mostly Lat-am, EU and English-speaking SMBs.
- Signals:
RemcosClient,watchdog, C2 usually on ports 2404 / 2700 / 8080. - References: MITRE ATT&CK S0332 · Malpedia.
Recent IOCs tagged #Remcos
No IOCs tagged #Remcos in the past 30 days. Year total: 289. Older data: api.tweetfeed.live/v1/year (all tags, filter for #Remcos).
Related tags
Frequently asked questions
What is Remcos?
Remcos (Remote Control and Surveillance) is a commercial Remote Access Tool sold by Breaking Security. Pirated builds are widely abused in phishing, and MITRE ATT&CK tracks it as S0332.
How is Remcos delivered in real campaigns?
Mostly as a second stage from phishing emails with invoice, shipping or DHL lures. The loader is usually an Office macro, an ISO / IMG file or an AutoIt dropper.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this Remcos subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
Remcos IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.