Picking Apart Remcos Botnet-In-A-Box
Summary: Cisco Talos documented multiple campaigns distributing the Remcos remote access tool, sold by a German-registered company called Breaking Security for €58 to €389 per license and payable in digital currencies. The campaigns used spear-phishing emails impersonating the Turkish Revenue Administration (GIB) and invoice-themed documents spoofing Iberia and AMC Aviation, with malicious Office macros that reconstruct an embedded downloader to fetch Remcos.
What's compelling: Breaking Security also sells a cryptor (Octopus Protector), a keylogger, a mass mailer and a DynDNS service, which together with Remcos give an actor the full toolset and infrastructure to build and run a botnet. Talos found the purported official reseller did not object when a user reported using the software to control 200 bots.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026