What is Remcos Remote Access Trojan?

Remcos Remote Access Trojan

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Windows devices; commercial RAT for surveillance

Source Attribution

Origin: MITRE
Source: MITRE ATT&CK · MalwareBytes
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: MITRE ATT&CK · MalwareBytes · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2016-01 discovered Remcos RAT first distributed
2019-05 updated Details documented by Malwarebytes

Quick Answer

Remcos is delivered via phishing documents and collects keystrokes, screenshots and webcam/mic data under a C2 dashboard.

Definition

Remcos ("Remote Control & Surveillance") is a commercial Windows RAT sold for legitimate use but widely deployed in phishing, keylogging and surveillance campaigns.

Overview

Remcos (“Remote Control & Surveillance”) is a commercial Windows RAT sold for legitimate use but widely deployed in phishing, keylogging and surveillance campaigns.

Behavior

Commercial RAT repurposed for attacks
Keylog + webcam surveillance
Delivered via phishing attachments

First Seen

2016-01

Target

Windows devices; commercial RAT for surveillance

Techniques: T1056, T1419, T1071
Campaigns: n/a
Related CVEs: n/a

Malware Intelligence

Family: Remcos Remote Access Trojan

Aliases: Remcos

Techniques: T1056, T1419, T1071

Targets: Windows devices; commercial RAT for surveillance

Behavior:

Commercial RAT repurposed for attacks
Keylog + webcam surveillance
Delivered via phishing attachments

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Remcos Remote Access Trojan. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Remcos Remote Access Trojan?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.