From a VHDX File to a Remcos RAT: Analyzing the Latest Phishing Technique

In a recent campaign reported by SANS, threat actors have utilized an innovative phishing approach leveraging Virtual Hard Disk (VHDX) files to deploy the infamous Remcos Remote Access Trojan (RAT). This specific tactic involves a malicious ZIP archive containing a VHDX file that, when mounted, automatically reveals a JavaScript file. Upon execution, this file initiates the deployment of the Remcos RAT, effectively bypassing some of the modern security measures implemented in Windows operating systems, particularly in environments with less stringent execution policies.

The campaign targeted organizations and individuals indiscriminately, casting a wide net to maximize impact. The timing of these attacks coincided with the dissemination of critical work-from-home directives, which increased the target pool as more users shifted to home networks, often with reduced security postures. Although specific actors were not definitively attributed, the use of Remcos aligns with tactics favored by certain Eastern European threat groups known for their persistent presence in the global cyber threat landscape.

How It Was Built

The delivery mechanism began with a phishing email crafted to appear mundane yet authoritative, leveraging social engineering to ensure compliance. A typical email subject line might read: “Important: Remote Work Policy Update – Action Required”. The sender identity was masked using a spoofed email address resembling an IT department: itdepartment@companyupdateteam.com.

The email body contained minimal text to reduce suspicion while emphasizing urgency:


Dear Employee,



Please find attached the latest remote work policy update. Kindly review and acknowledge receipt.



Best regards,

Company Update Team

Attached to the email was a ZIP file named RemotePolicyUpdate.zip, disguising the embedded malicious VHDX file, UpdatePolicy.vhdx. Once the user mounted this file, a hidden JavaScript named UpdatePolicy.js was executed, establishing a connection to a command and control server using a legitimate-looking domain pattern like updateservice-network.com. This initiated the download and execution of the Remcos RAT onto the victim’s system.

Why It Worked

The campaign succeeded due to several strategic choices:

Attachment Format: By using a VHDX file, the attackers bypassed many traditional email security solutions that might only scan files like .exe or .docx. The VHDX is recognized and accessible on modern Windows platforms.
Social Engineering: The email exploited psychological triggers of urgency and authority. Users, driven by the need to comply with IT’s authoritative requests, were more likely to engage without thorough inspection.
Domain Name Selection: The malicious domain looked legitimate, which aided in evading casual scrutiny and added a veneer of authenticity to the operation.

The psychological urgency combined with seemingly legitimate technological presentations can often override user skepticism, paving the way for successful exploitation.

Operator Takeaways

This campaign highlights several key takeaways that penetration testers can adapt and refine for simulated phishing engagements:

File Type Utilization: Incorporate less commonly scanned file types like VHDX into payload designs to exploit gaps in file scanning protocols.
User Psychology: Design email lures that emphasize urgency combined with authoritative tones to compel action, leveraging company norms and compliance culture.
Domain Crafting: Register domains that closely mimic legitimate service providers to enhance perceived authenticity and bypass superficial inspections.

Good / Better / Best

Good: Use realistic sender addresses and genuine-looking domain names to improve email delivery success.
Better: Integrate multiple file types like VHDX files within archives for more complex multi-stage attacks, increasing the likelihood of payload execution.
Best: Combine sophisticated technical setups with psychological manipulation through well-crafted stories that align with current events (e.g., pandemic policy updates) for maximal engagement and execution.