{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/clearfake/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["remcos","clearfake","exploit-kit","rat"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis brief is based on IOCs identified by Maltrail on February 26, 2026. The IOCs are associated with two distinct threats: Remcos RAT and EK_ClearFake. Remcos RAT is a commercially available remote access trojan often used for malicious purposes, including data theft and surveillance. EK_ClearFake is an exploit kit known for distributing various malware through compromised websites. The domains associated with EK_ClearFake are likely used to host or redirect to landing pages containing exploits. Identifying and blocking these IOCs is crucial to preventing potential infections and mitigating the risk of compromise. This information is relevant for defenders looking to proactively block connections to known malicious infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003cp\u003eThe following is a generalized attack chain based on typical Remcos RAT and Exploit Kit (EK_ClearFake) operations.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Compromise (EK_ClearFake):\u003c/strong\u003e User visits a website compromised with EK_ClearFake.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRedirection (EK_ClearFake):\u003c/strong\u003e The compromised website redirects the user to a landing page controlled by the attacker, often using domains like those listed in the IOCs (e.g., \u003ccode\u003e13nq2ksp.lunarbridge.digital\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExploit Delivery (EK_ClearFake):\u003c/strong\u003e The landing page probes the user's browser for vulnerabilities.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalware Installation (EK_ClearFake):\u003c/strong\u003e If a vulnerability is found, the EK_ClearFake delivers and executes a malicious payload.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRemcos RAT Installation (Remcos):\u003c/strong\u003e The delivered payload installs Remcos RAT on the victim's machine.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand and Control (Remcos):\u003c/strong\u003e Remcos RAT establishes a connection to a command-and-control server (e.g., \u003ccode\u003eoficialrem.duckdns.org\u003c/code\u003e) controlled by the attacker.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration (Remcos):\u003c/strong\u003e The attacker uses Remcos RAT to steal sensitive data from the compromised system.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLateral Movement/Further Exploitation (Remcos):\u003c/strong\u003e The attacker leverages the compromised system to move laterally within the network or deploy additional malware.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack involving Remcos RAT can lead to significant data breaches, financial losses, and reputational damage. EK_ClearFake infections can result in widespread malware infections across an organization. The impact could include the theft of sensitive data, disruption of business operations, and the need for extensive incident response efforts. While the number of direct victims from this particular Maltrail feed is unknown, the potential for widespread impact is high given the nature of the tools involved.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock the listed domains associated with EK_ClearFake (e.g., \u003ccode\u003e13nq2ksp.lunarbridge.digital\u003c/code\u003e) at the DNS resolver level to prevent connections to malicious landing pages.\u003c/li\u003e\n\u003cli\u003eBlock the IP address \u003ccode\u003e186.169.75.221\u003c/code\u003e and domain \u003ccode\u003eoficialrem.duckdns.org\u003c/code\u003e associated with Remcos RAT at the firewall to disrupt command and control communications.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules provided below to your SIEM to detect potential Remcos RAT or EK_ClearFake activity within your environment.\u003c/li\u003e\n\u003cli\u003eInvestigate systems that communicate with the IOCs identified in this brief to determine the extent of any potential compromise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-02-26T17:00:11Z","date_published":"2026-02-26T17:00:11Z","id":"https://feed.craftedsignal.io/briefs/2026-02-26-maltrail-iocs/","summary":"This brief summarizes IOCs related to Remcos RAT, a remote access trojan, and EK_ClearFake, an exploit kit, as identified by Maltrail on February 26, 2026.","title":"Maltrail IOCs for Remcos RAT and EK_ClearFake","url":"https://feed.craftedsignal.io/briefs/2026-02-26-maltrail-iocs/"}],"language":"en","title":"CraftedSignal Threat Feed - Clearfake","version":"https://jsonfeed.org/version/1.1"}