MalwarePublished 6 Nov 2026

Remcos RAT

Source AlienVault OTX General

Description

This intelligence analysis covers a malicious campaign deploying Remcos RAT, a commercially available remote access trojan. The infection starts with a weaponized Excel spreadsheet that uses VBA macros to execute PowerShell commands, which then download additional malicious scripts from attacker-controlled domains. The multi-stage attack culminates in the deployment of the Remcos RAT payload. The campaign uses social engineering with financial-themed lures to trick victims into enabling macros, facilitating the infection. Command and control infrastructure involves domains dvrlists[.]com and lbl[.]support.

Impact

Successful exploitation results in the deployment of Remcos RAT, granting attackers remote access to compromised systems. This can lead to unauthorized control, data exfiltration, surveillance, and further malicious activity. The infection vector relies on user interaction to enable macros, which if successful, compromises the victim's system. No known exploits in the wild or confirmed active exploitation are reported at this time.

Defensive guidance

Mitigation focuses on user education to avoid enabling macros in unsolicited Excel files, blocking or monitoring PowerShell execution from untrusted sources, and restricting access to known malicious domains such as dvrlists[.]com and lbl[.]support. Endpoint protection solutions should be updated to detect and block Remcos RAT and associated scripts. Since this is a social engineering-based attack, raising awareness about the risks of enabling macros in documents from unknown or untrusted sources is critical.

Summary

The threat involves a multi-stage infection chain beginning with a weaponized Excel spreadsheet named Remittance Advice.xlsm that executes VBA macros. Upon opening, the macros trigger PowerShell to retrieve remote scripts (edi.vbs and firewall.vbs) from malicious domains. These scripts further the infection process, ultimately deploying the Remcos RAT payload, which provides remote access capabilities to the attacker. The campaign leverages social engineering tactics, specifically financial-themed lures, to convince victims to enable macros, a necessary step for the infection to proceed. Command and control communications are established via domains dvrlists[.]com and lbl[.]support. The campaign is characterized by typical RAT behavior and multi-stage execution but no specific CVE details or exploit code are provided.

Indicators of compromise

URLs 1

http://lbl.support

Hashes 2

50f2ff7d96392fcfe6ed57a1ff71ae9c87a1346ff3694173a255b67e9ff8a208
abf8ada022fce92c24e0aead4f1b1ae8991002130bbbc4335f3381972683b400

CVEs 2

CVE-2026-109618
CVE-2026-109619

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Nov 2026, 19:35 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

URLs 1

Hashes 2

CVEs 2

Community reviews

Related threats