New IDAT Loader Attacks Using Steganography to Deploy Remcos RAT

Ukrainian entities in Finland were targeted by a campaign that used IDAT Loader (overlapping with Hijack Loader) and steganographic PNGs to locate and deploy Remcos RAT, an activity attributed to the CERT-UA tracked cluster UAC-0184. CERT-UA also reported related campaigns delivering COOKBOX via Signal-distributed Excel documents and the resurgence of PikaBot, while IDAT/Hijack Loader families have been observed distributing other payloads such as DanaBot, SystemBC, and RedLine Stealer, highlighting active, evolving malware threats in the region.