New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack

A new campaign dubbed SHADOW#REACTOR has been disclosed for delivering Remcos RAT through an evasive multi-stage Windows attack, with researchers from Securonix detailing an orchestrated chain that begins with an obfuscated Visual Basic Script launcher triggered via wscript.exe.

The chain uses a PowerShell downloader to fetch fragmented, text-based payloads from a remote host, which are then reconstructed into encoded loaders and decoded in memory by a .NET Reactor–protected assembly before obtaining a Remcos configuration; the final stage relies on MSBuild.exe as a living-off-the-land binary to complete execution and deploy the Remcos backdoor.

The operation utilises intermediate text-only stagers, in-memory loaders, and anti-detection techniques to complicate analysis, with the loader enabling persistence and procurement of the next-stage malware while performing anti-debugging and anti-VM checks. The infection sequence also includes dropping a text file in the machine’s Temp directory and re-downloading payload fragments if they are incomplete, thereby creating a self-healing aspect to the campaign.

The activity is described as broad and opportunistic, targeting enterprise and small-to-medium business environments, and while it aligns with initial access brokers’ tradecraft, there is no evidence attributing it to a known threat group, according to the researchers.