Rescoms

Rescoms, also known as Remcos, is a remote access trojan (RAT) malware designed to exploit and damage computer systems by stealing sensitive information. It was primarily used in significant phishing campaigns across Central and Eastern Europe during the second half of 2023. These campaigns utilized typosquatting, a popular technique that involves the use of misspelled URLs to mislead users. The Rescoms executable was delivered to potential victims, protected by AceCryptor, with the primary objectives being credential theft and initial access to company networks. In May 2024, a new phishing campaign was carried out in Poland, which saw a shift in the malware delivery method. Attackers switched from using AceCryptor to ModiLoader for delivering malware. Three different malware families were deployed via ModiLoader: Rescoms, Agent Tesla, and Formbook. These malware families were used as final payloads, indicating a strategic evolution in the attackers' approach to be more successful in their illicit activities. Additionally, threat actors have used Rugmi, a tool containing a downloader for the encrypted payload and two other loaders, to distribute various information-stealing malware. This includes Vidar, RecordBreaker or Raccoon Stealer V2, Lumma Stealer or LummaC2, and Rescoms, according to a report from ESET Research. Despite the change in delivery methods and the inclusion of new malware families, Rescoms remains a prevalent threat due to its ability to steal sensitive information and gain control over infected systems.