New Remcos RAT campaign aimed at South Korea uncovered

GBHackers News reports that intrusions spreading the RemcosRAT malware via illegal online gambling-linked tools and counterfeit VeraCrypt installers have been launched against South Korean users.

Telegram and web browsers have been leveraged by attackers to target illegal sports-betting and casino site users and operators with the "Blocklist User DB Lookup *****Club" program, whose executable includes a pair of malignant VBS scripts that facilitate Remcos RAT delivery, a report from the AhnLab Security Intelligence Center showed. Attackers have also used trojanized installers for the VeraCrypt disk encryption tool to trigger a multi-stage attack chain leading to the decryption of Remcos RAT.

Aside from enabling remote command execution, file management, and process control, Remcos RAT also allows screenshot capturing, webcam and microphone surveillance, keylogging, clipboard monitoring, and browser- and app-stored data compromise. Organizations and users have been warned against downloading installers from unofficial sources to mitigate potential compromise.