VHDX Files Exploited to Deploy Remcos RAT via Multi-Stage Attack

A recent cyber campaign utilizes a malicious ZIP archive containing a VHDX file to deliver the Remcos Remote Access Trojan (RAT). Upon mounting the VHDX, an obfuscated JavaScript file executes, triggering a series of PowerShell scripts via WMI to evade detection. The attack exploits common security controls, employing techniques like string obfuscation and reflective .NET loading. The final payload, Remcos RAT, is injected into a legitimate Windows process, backgroundTaskHost.exe, to conceal its activity. Organizations are advised to prevent mounting of untrusted VHDX files and monitor for suspicious process creation. The infection path has been traced from the initial JavaScript execution to the deployment of the Remcos payload. This incident highlights the evolving tactics used by cybercriminals to bypass security measures.

Key Points: • Malicious ZIP archive containing a VHDX file used to deliver Remcos RAT. • Attack employs obfuscated JavaScript and PowerShell scripts to evade detection. • Organizations should restrict mounting of untrusted VHDX files and monitor suspicious activities.