Shadow#Reactor Uses Text Files to Deliver Remcos RAT

Shadow#Reactor’s Sophisticated Malware Delivery System

Attackers are employing a novel delivery method using text-only files to deploy the Remcos RAT, demonstrating a sophisticated technique to evade security tools and exploit existing system utilities. The Shadow#Reactor campaign utilizes a multi-stage process to deliver malware, relying heavily on the target’s own resources.

This campaign highlights the increasing trend of attackers leveraging living-off-the-land tactics, which can bypass signature-based detection and significantly increase the cost of remediation due to the difficulty in identifying malicious activity amongst legitimate processes.

Key Insights

• Remcos RAT: A commercially available remote access tool repurposed for malicious use.
• Living-off-the-Land: Attackers utilize legitimate system tools (like PowerShell and Windows Script Host) to perform malicious actions, reducing reliance on external malware.
• Obfuscation: The use of ”%” character corruption in PowerShell payloads avoids immediate detection by system decoders.

Practical Applications

• Use Case: Opportunistic targeting of enterprises and SMBs with financially motivated goals, potentially through initial access brokerage.
• Pitfall: Over-reliance on signature-based detection; text-based payloads can bypass these systems, requiring behavioral analysis.

References:

• https://www.darkreading.com/endpoint-security/shadow-reactor-uses-text-files-to-deliver-remcos-rat