Remcos RAT Analysis: How the Windows Remote Access Trojan Operates

Key Takeaways Remcos RAT is a Windows remote access trojan first introduced in 2016 by Breaking Security as a remote administration product. Once deployed, Remcos hands an operator near-complete control, enabling command execution, credential theft, and silent recording of user activity. Remcos combines defense evasion via process injection , privilege escalation through a COM-based UAC bypass , and multi-layered registry and watchdog persistence . Its surveillance toolkit includes keylogging , periodic screenshots , audio recording , an optional webcam module , and browser credential and cookie wiping . The Picus Security Validation Platform simulates Remcos RAT attacks, letting organizations test security controls against this threat within minutes. Remcos (Remote Control and Surveillance) is a Windows remote access trojan (RAT) that was first introduced in 2016 by the company Breaking Security, which marketed it as a legitimate remote administration product. Since then, it has been widely adopted by threat actors and has become one of the most prevalent commodity RATs in the wild.