Fileless Remcos Attacks: Injecting Malicious Code into RMClient to Evade EDR
CyberProof researchers have identified a notable increase in Remcos (Remote Control & Surveillance Software) campaigns during September and October 2025. These campaigns utilize advanced fileless techniques to bypass endpoint detection and response (EDR)…
CyberProof researchers have identified a notable increase in Remcos (Remote Control & Surveillance Software) campaigns during September and October 2025. These campaigns utilize advanced fileless techniques to bypass endpoint detection and response (EDR) systems.
The attackers employ obfuscated PowerShell scripts and process hollowing techniques within Microsoft's RMClient.exe to maintain stealthy persistence and target browser credentials.
Remcos, though marketed as a legitimate remote access tool, has been repurposed by threat actors for unauthorized activities. The observed attack vector involves enticing recipients with a credible “inquiry order” email, leading them to download a malicious file via Microsoft Edge. Upon extraction, a batch file is dropped into the user's Temp directory, resembling the path:
C:\Users<username>\AppData\Local\Temp\00f764ae-38a7-46c6-9b3e-5131512535c7_EFEMMAK TURKEY INQUIRY ORDER NR 09162025.bat.
This batch file initiates an obfuscated PowerShell script that uses functions named ‘Lotusblo’ and ‘Garrots’ to disguise its actual purpose.
The embedded PowerShell code creates a hidden process, utilizes a custom string de-obfuscator, and dynamically executes downloaded payloads using Invoke-Expression. Configured to enforce TLS 1.2 and a custom User-Agent, the script aims to retrieve ‘Sluknin.afm’ from hxxps://icebergtbilisi.ge/Sluknin.afm repeatedly until successful. Upon download, the file undergoes Base64 decoding, GZip decompression, and execution via Invoke-Expression.
Recent incidents began with a spear-phishing email containing an archive named “EFEMMAK TURKEY INQUIRY ORDER NR 09162025.gz.” A subsequent PowerShell snippet executed msiexec.exe to advance the attack:
These campaigns utilize advanced fileless techniques to bypass endpoint detection and response (EDR) systems.
powershell powershell.exe -windowstyle hidden "spsv exergonic; function Lotusblo ... Garrots (Lotusblo '…')"
This process concealed malicious parameters and utilized msiexec.exe to perform process hollowing, hosting the Remcos payload within RMClient.exe.
The fileless technique exploits the legitimate RMClient binary, verified by its SHA-256 hash ‘8f6a3b111f6e0498cb677b175966175bfa53e58c9fb41ddb63c7b7568e24c760’, to obscure malicious activities. EDR systems detected anomalies when msiexec.exe sought to perform process hollowing within RMClient.exe, triggering alerts as the RAT accessed browser password storage files.
CyberProof analysts noted that the injected Remcos instance actively accessed saved credentials in Chromium-based browsers, suggesting a focus on credential theft through opportunistic attacks. Post-injection analysis of msiexec’s process ID revealed randomly named files in the Temp directory and multiple command-and-control (C2) communications.
Initial C2 connections to domains such as icebergtbilisi.ge were successful, though subsequent attempts failed. Network forensics confirmed GET requests to malicious endpoints using a custom User-Agent string embedded in the PowerShell loader.
To aid in detection, CyberProof researchers provided a Kusto Query Language (KQL) hunting query to capture related events:
text union DeviceEvents, DeviceProcessEvents | where FileName contains "rmclient.exe" | where ProcessCommandLine contains "AppData\\Local\\Temp" | project Timestamp, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName
This query highlights instances of RMClient.exe launched by msiexec from temporary folders, identifying potential fileless Remcos infections.
CyberProof continues to monitor this evolving threat. Initial evaluations suggest that attackers may have compromised legitimate websites to host additional payloads. Due to the fileless approach's ability to evade traditional signature-based detections, organizations are advised to enhance behavioral monitoring, enforce stringent PowerShell execution policies, and implement real-time memory scanning to detect unusual process hollowing and dynamic code execution. Updates to detection rules and threat intelligence feeds will be disseminated as new indicators become available.
Based on reporting by GBHackers.