Cisco Links Remote Access Tool Remcos to Cybercriminal Underground

Cisco Talos reports that Remcos, a commercially sold remote access tool from Breaking Security, is widely abused by multiple actors in spear-phishing campaigns that use malicious Office macros to drop a downloader and retrieve the RAT, enabling botnet creation and full Windows system control; related products (keylogger, mass mailer, DynDNS) further facilitate botnet operations, and Talos publishes a decoder to extract C2 information and recommends mitigation with security controls.