Shadow#Reactor Delivers Remcos RAT Through Text File Phishing in 2024
In mid-2024, a threat group known as Shadow#Reactor orchestrated a sophisticated phishing campaign to deliver the Remcos Remote Access Trojan (RAT). Leveraging seemingly benign text files as carriers for malicious scripts, attackers bypassed security solutions and enticed targets to unwittingly initiate the infection through trusted system utilities. The campaign’s stealth allowed the attackers to establish command and control, enabling surveillance, credential theft, and potential lateral movement within the impacted organizations. This incident exemplifies the evolution of social engineering and malware delivery tactics that evade conventional defenses. The rise in attackers abusing native utilities with unobtrusive file types serves as a stark warning for organizations to re-evaluate endpoint protections and user awareness, especially as threat actors target a wide range of industries with novel bait methods.
Kill Chain
