Picking Apart Remcos Botnet-In-A-Box

guest · Aug 22, 2018

Picking Apart Remcos Botnet-In-A-Box
August 22, 2018
https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html

Cisco Talos has recently observed multiple campaigns using the Remcos remote access tool (RAT) that is offered for sale by a company called Breaking Security. While the company says it will only sell the software for legitimate uses as described in comments in response to the article here and will revoke the licenses for users not following their EULA, the sale of the RAT gives attackers everything they need to establish and run a potentially illegal botnet.

In addition to Remcos, Breaking Security is also offering Octopus Protector, a cryptor designed to allow malicious software to bypass detection by anti-malware products by encrypting the software on the disk. [...]
CONCLUSION
While the organization that sells Remcos claims that the application is only for legal use, our research indicates it is still being used extensively by malicious attackers, as well. In some cases, attackers are strategically targeting victims to attempt to gain access to organizations that operate as part of the supply chain for various critical infrastructure sectors.
Click to expand...

Log in or Sign up

Picking Apart Remcos Botnet-In-A-Box

guest Guest

Log in or Sign up

Picking Apart Remcos Botnet-In-A-Box

guest Guest

Useful Searches