Maltrail IOCs for Remcos RAT and EK_ClearFake

This brief is based on IOCs identified by Maltrail on February 26, 2026. The IOCs are associated with two distinct threats: Remcos RAT and EK_ClearFake. Remcos RAT is a commercially available remote access trojan often used for malicious purposes, including data theft and surveillance. EK_ClearFake is an exploit kit known for distributing various malware through compromised websites. The domains associated with EK_ClearFake are likely used to host or redirect to landing pages containing exploits. Identifying and blocking these IOCs is crucial to preventing potential infections and mitigating the risk of compromise. This information is relevant for defenders looking to proactively block connections to known malicious infrastructure.

Attack Chain

The following is a generalized attack chain based on typical Remcos RAT and Exploit Kit (EK_ClearFake) operations.

1. Initial Compromise (EK_ClearFake): User visits a website compromised with EK_ClearFake.
2. Redirection (EK_ClearFake): The compromised website redirects the user to a landing page controlled by the attacker, often using domains like those listed in the IOCs (e.g., 13nq2ksp.lunarbridge.digital).
3. Exploit Delivery (EK_ClearFake): The landing page probes the user's browser for vulnerabilities.
4. Malware Installation (EK_ClearFake): If a vulnerability is found, the EK_ClearFake delivers and executes a malicious payload.
5. Remcos RAT Installation (Remcos): The delivered payload installs Remcos RAT on the victim's machine.
6. Command and Control (Remcos): Remcos RAT establishes a connection to a command-and-control server (e.g., oficialrem.duckdns.org) controlled by the attacker.
7. Data Exfiltration (Remcos): The attacker uses Remcos RAT to steal sensitive data from the compromised system.
8. Lateral Movement/Further Exploitation (Remcos): The attacker leverages the compromised system to move laterally within the network or deploy additional malware.

Impact

A successful attack involving Remcos RAT can lead to significant data breaches, financial losses, and reputational damage. EK_ClearFake infections can result in widespread malware infections across an organization. The impact could include the theft of sensitive data, disruption of business operations, and the need for extensive incident response efforts. While the number of direct victims from this particular Maltrail feed is unknown, the potential for widespread impact is high given the nature of the tools involved.

Recommendation

• Block the listed domains associated with EK_ClearFake (e.g., 13nq2ksp.lunarbridge.digital) at the DNS resolver level to prevent connections to malicious landing pages.
• Block the IP address 186.169.75.221 and domain oficialrem.duckdns.org associated with Remcos RAT at the firewall to disrupt command and control communications.
• Deploy the Sigma rules provided below to your SIEM to detect potential Remcos RAT or EK_ClearFake activity within your environment.
• Investigate systems that communicate with the IOCs identified in this brief to determine the extent of any potential compromise.