Remcos RAT: New command-and-control infrastructure

Abuse.ch ThreatFox has documented 15 new command-and-control (C2) indicators associated with the Remcos remote access trojan (RAT). These indicators, which include both domains and IP addresses, represent active infrastructure identified on 2026-11-04.

Recommendation

• Block the domains and IP addresses listed in the IOC table at the DNS resolver and perimeter firewall.
• Search proxy and firewall logs for internal host communication with the identified C2 infrastructure.
• Audit endpoints for unauthorized persistence mechanisms often associated with Remcos, such as registry run keys or scheduled tasks.