Sophisticated Malware Campaign Uncovered: Hackers Use Deceptive PDFs to Deliver Remcos RAT

A New Era of Sophisticated Threats: How Remcos RAT is Evading Detection Researchers at Trustwave SpiderLabs have exposed a complex cyber threat, revealing a malspam campaign that distributes the notorious RemcosRAT malware on Windows systems. The campaign’s sophistication lies in its use of a fake payment notice, disguised as a SWIFT copy, to trick victims…

Editorial Staff

May 5, 2025

2–3 minutes

hackers, Malware, PDF, Remcos RAT, Trustwave SpiderLabs

A New Era of Sophisticated Threats: How Remcos RAT is Evading Detection

Visual representation of a malware attack involving a malicious PDF file on a digital device, highlighting the cyber threats associated with Remcos RAT.

Researchers at Trustwave SpiderLabs have exposed a complex cyber threat, revealing a malspam campaign that distributes the notorious RemcosRAT malware on Windows systems. The campaign’s sophistication lies in its use of a fake payment notice, disguised as a SWIFT copy, to trick victims into downloading a malicious PDF.

The phishing email, which serves as the campaign’s entry point, attaches a PDF file containing a malicious link that points to a webpage: https://huadongarmouredcable.com/pdf/default.php. This link lures victims into a multi-stage infection process designed to deliver RemcosRAT, a malware known for its ability to remotely control infected systems.

The attack unfolds in several carefully orchestrated steps. The initial PDF link leads to the download and execution of a first-stage JavaScript (JS) file. This script then fetches a second-stage JS file, which in turn invokes a PowerShell script. The PowerShell script downloads an image file that appears harmless but is embedded with the RemcosRAT payload, concealed using steganography.

Once decoded and executed, the malware establishes a connection to a command-and-control (C2) server, giving attackers remote access to the victim’s system. The email, which claims to be a legitimate bank transfer confirmation, includes a message body with a fake payment notice and urges the recipient to open the attached PDF for further details.

The email’s metadata reveals a message body size of 525 bytes, with the sender posing as “Arabella Lee” and the content designed to appear authentic with a polite closing: “If you have any queries, please let me know.” SpiderLabs has shared indicators of compromise (IoCs) to help organizations detect and block the threat.

Key Indicators of Compromise:

Malicious URLs involved

C2 server operating at tcp://www.rickscottflorida.com:2404

The use of steganography to conceal the payload within an image file highlights the advanced tactics employed by the attackers to evade detection. This campaign demonstrates a clear evolution in malware delivery methods, combining social engineering with obfuscated scripts and hidden payloads to bypass traditional security measures.

Organizations are urged to update their security protocols, monitor for the provided IoCs, and educate employees about the risks of opening attachments or clicking links in unexpected emails. This discovery adds to the growing list of Remcos RAT campaigns, a malware strain known for its versatility and use in espionage, data theft, and other malicious activities.

As cybercriminals continue to refine their techniques, cybersecurity experts stress the need for robust defenses and proactive threat hunting to mitigate such risks.