Netskope Threat Labs

Remsec

ATP Sandbox Adv. HeuristicsAV

Stats

First seen
May 2023
Last seen
October 2026

MITRE ATT&CK techniques

30 techniques across 9 tactics.

TA0002 Execution

TA0004 Privilege Escalation

  • T1068Exploitation for Privilege Escalation

TA0005 Stealth

TA0006 Credential Access

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1018Remote System Discovery
  • T1033System Owner/User Discovery
  • T1046Network Service Discovery
  • T1049System Network Connections Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1087Account Discovery
  • T1518Software Discovery
  • T1652Device Driver Discovery

TA0009 Collection

TA0011 Command and Control

TA0010 Exfiltration

  • T1048Exfiltration Over Alternative Protocol
    • T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
  • T1052Exfiltration Over Physical Medium

TA0112 Defense Impairment

Associated groups

Alert name variants

Alert Name
Gen:Variant.Remsec.1
Win32.Backdoor.Remsec
Win64.Backdoor.Remsec
Win64.Trojan.Remsec

Related families

InvisiMolePlugXBazarCobalt StrikeEmpire