SLTT C2 Traffic Tied to Remus Malware Distribution Operation

MITRE Techniques

• [T1056.001] Keylogging – The campaign used clipboard hijacking and input capture-style behavior to deliver commands to victims (‘writes it to the victim’s clipboard’).
• [T1027] Obfuscated Files or Information – Remus protected C2 configuration with ChaCha20 and used obfuscated scripts to hinder analysis (‘protect their embedded C2 configuration’, ‘obfuscated commands’).
• [T1055] Process Injection – Remus targeted browser credentials via browser-process injection (‘via browser-process injection’).
• [T1115] Clipboard Data – The ClickFix chain wrote a malicious command into the clipboard for the victim to paste (‘writes it to the victim’s clipboard’).
• [T1204.002] Malicious File – User Execution: Malicious File – Victims were lured into running cracked software and loader files (‘cracked software lures’, ‘cracked game installer’).
• [T1036] Masquerading – Samples spoofed the Host header to appear as microsoft[.]com or github[.]com (‘spoofing the Host header to microsoft[.]com or github[.]com’).
• [T1071.001] Web Protocols – Remus registered and exfiltrated over HTTP/POST (‘registers with its C2 over HTTP’, ‘exfiltrates via multipart POST’).
• [T1090] Proxy – The campaign used Cloudflare proxying on loader domains (‘Cloudflare proxying’).
• [T1105] Ingress Tool Transfer – Loader chains fetched shellcode and payloads from remote infrastructure (‘fetches the final encrypted payload’, ‘retrieves a loader PE first’).
• [T1021.001] Remote Services: Remote Desktop Protocol – Not observed directly; no supported evidence in the article for RDP use.
• [T1106] Native API – Remus used direct syscall patterns and syscall abuse in loaders (‘direct syscall pattern’, ‘syscall.Syscall execution transfer abuse’).
• [T1140] Deobfuscate/Decode Files or Information – Samples decrypted embedded payloads and config at runtime (‘decrypts it at runtime’, ‘python to decrypt the configuration’).
• [T1218.005] System Binary Proxy Execution: Mshta – Not present in the article; omitted from operational assessment.
• [T1202] Indirect Command Execution – The ClickFix chain used PowerShell to execute payloads in memory (‘decrypted and executed entirely within the PowerShell process’s own memory’).