Remcos
Software · ATTACK:enterprise:S0332
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0332",
"title": "Remcos",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0332",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--7cd0bc75-055b-4098-a00e-83dc8beaff14",
"external_id": "S0332",
"domain": "enterprise",
"created": "2019-01-29T18:55:20.245Z",
"modified": "2026-04-23T03:33:15.712Z",
"version": "1.4",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Remcos"
},
{
"source_name": "Fortinet Remcos Feb 2017",
"url": "https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"
},
{
"source_name": "Talos Remcos Aug 2018",
"url": "https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html"
},
{
"source_name": "Riskiq Remcos Jan 2018",
"url": "https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"
}
]
}Explicit source assertions (43)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04b9d1e7-6deb-46f8-9fe3-9fb870ba8d72
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1be18787-844d-4135-9781-e5b6a8e76d14
Fortinet Remcos Feb 2017ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2147037d-4af2-4492-9c86-c85dfc6965af
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:S0332
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22d01d2c-6c2e-4e59-98ac-393aef16ffe3
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--441ef1f7-79b7-476a-8c1e-943439e65dd1
Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54e70260-cbf3-4c6b-bd30-208329cfef26
Fortinet Remcos Feb 2017ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55b42570-f8fe-472f-ae12-e3dd0b6de9c6
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57966b1d-4770-49fb-afb6-b02699bb8154
Riskiq Remcos Jan 2018ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ed5deda-543f-40f7-8f5d-df8f93c545e2
Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66f2f7b3-3df9-4d4a-bedc-ecacac3039e8
Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d146e81-301d-43ed-bd5a-90675caddd49
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71a121ba-b01c-418c-af8d-63df2cec70de
Talos Remcos Aug 2018 · Check Point Blind Eagle MAR 2025ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--754c12f9-58a9-4cf0-af08-b5da6d14a767
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0332
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c7b3761-80ff-4469-ad5b-9cc9a26078db
VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cb5d843-e5b6-416a-b721-aa6b4c1ae2f3
Talos Remcos Aug 2018ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f58f0fa-54ca-412e-a681-2f864e217039
Fortinet Remcos Feb 2017 · Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8fc92d76-ac57-4d4e-bdbd-3e2f10142cb5
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--945dface-ae29-4baa-ad2d-45c27029936a
Fortinet Remcos Feb 2017ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--988a0f0f-b3dc-4ff7-8062-29d3975cb897
Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4d59eb9-9390-4f3c-9659-0083a041c576
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9154086-7359-4e2b-b70f-edcde2d43a80
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa70970f-e39d-4808-baea-c02c4435e02f
Check Point Blind Eagle MAR 2025ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad787fb5-9d63-423d-941f-bfe7648b2e24
Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S0332
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afabeca2-f30b-40c6-a2d5-aee4be37aa29
Check Point Blind Eagle MAR 2025 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b13ba0b6-742f-48c4-b7d3-75f31ca4f18e
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be872040-4179-4076-b371-923fe2a2b4de
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:S0332
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfe45239-7fa4-45a5-bb47-86c4ae46906c
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3f01b1a-82c8-416c-9416-6b8469c89e65
Check Point Blind Eagle MAR 2025ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c50fd202-d4af-4157-b368-b4525af075c1
Fortinet Remcos Feb 2017 · Talos Remcos Aug 2018ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c73f5693-e40c-48a9-b41c-8207f7180523
Fortinet Remcos Feb 2017ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c844b416-6de4-4fd5-9255-91c1783cad2a
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1564
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca824912-36d7-4fa9-a2ea-b9b3da431b15
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cafaa08a-1f40-40cb-a3fd-c507a1cc6e40
Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce85be06-0f74-480e-b55a-df92f6989902
Fortinet Remcos Feb 2017 · Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce870bcc-ce38-410c-9615-5ebb974fdf8d
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d45006be-8b4d-4eab-a76a-f940fecf83f9
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:S0332
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4007652-cc24-4786-926f-db4ff8349e88
ESET Operation Spalax Jan 2021ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5d5ede1-2e34-4a3a-9328-a151bedff462
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e678f070-2fb7-41dc-b63f-8dba148a5f97
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e87ba6d8-8228-45af-b235-54a0e0666a23
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f470eced-1e1c-49a8-b3b2-5ded410dc2e2
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa1dff90-adae-4aea-a9c2-fd25969e5bd3
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff314a48-663e-4ccd-969e-1b66ab220ee1
Check Point Blind Eagle MAR 2025