How attackers built a RAT on a Windows machine using its own .NET compiler

A UK medical-practice endpoint was compromised in May 2026 when an attacker used PowerShell and the .NET compiler to build and execute a Remcos RAT on-host (compile-after-delivery / fileless techniques), evading signature AV; recurring DNS beaconing to a malicious domain was detected and blocked by DNS filtering, which contained the C2 channel. The report maps the chain to MITRE ATT&CK techniques, highlights failures (execution policy, lack of application control, endpoints running as SYSTEM), and recommends layered controls—AppLocker/WDAC, constrained language mode, AMSI/script block logging, least privilege, and DNS filtering—to prevent or detect similar intrusions.