Remcos RAT Targets Europe: New AMSI and ETW Evasion Tactics Uncovered
Essential information
- Published
- 05/03/2025 14:57
- Modified
- 05/03/2025 15:03
- Tags
- 2025-03-05 phishing powershell rat remcos vb script zip
- Related entities
- 7 observables, 3 techniques (mitre), 1 malware
Description
This week, the SonicWall threat research team discovered a new update in the Remcos infection chain aimed at enhancing its stealth by patching AMSI scanning and ETW logging to evade detection. This loader was seen distributing Async RAT in the past but now it has extended its functionality to Remcos RAT and other malware families. From our analysis, it seems to be targeting European institutions.