Remcos RAT Expands Real-Time Surveillance Capabilities

Point Wild's Lat61 team describes a new Remcos RAT variant that shifts from local data staging to real-time exfiltration: it downloads modular DLLs (including live webcam streaming), transmits keystrokes immediately to C2, decrypts configuration only in memory, resolves Windows APIs dynamically, employs persistence and cleanup routines, and uses a mutex to limit instances—features that improve stealth and reduce forensic artefacts.