Remcos command-and-control activity: what practitioners need to act on

TL;DR: More than 150 active Remcos command-and-control servers were tracked in a month, with most listening on port 2404 and a subset exposing SMB and RDP, according to Censys research, while the malware kept access through scheduled tasks and Run-key persistence. Persistent infrastructure, not just initial delivery, remains the real operational risk.

Editorial analysis by NHI Mgmt Group, based on content published by Censys: “Censys Threat Overview: Mapping Remcos C2 Activity at Internet Scale”.

By the numbers:

• Censys consistently tracked over 150 active Remcos command-and-control servers between October 14 and November 14, 2025.
• Most Remcos servers listened on port 2404, commonly associated with the tool, during the same tracking window.

Key questions

Q: What breaks when remote support tools are allowed to persist after compromise?

A: The main failure is that legitimate administration software becomes an attacker-controlled access channel.

Q: Why do remote access tools increase the impact of credential theft on endpoints and online accounts?

A: Remote access tools can turn one stolen password into full interactive control of a machine, especially when sessions are unattended or trusted by default.

Q: What are the signs that malware is using command-and-control channels?

A: Common signs include unusual outbound connections, encrypted traffic to unfamiliar destinations, repeat beaconing, and processes that should not be making network calls.

Practitioner guidance

• Hunt for autostart persistence mechanisms Search endpoints for suspicious Scheduled Task creation, Run-key entries, and executable names that mimic system binaries on hosts with outbound Remcos-like beaconing.
• Baseline outbound C2 behaviour Flag repeated HTTP or HTTPS connections on ports 2404, 80, 443, 8080, 5000, 5060, 5061, 8268, and 8808 when the traffic shows encoded POST bodies or unusual TLS settings.
• Correlate credential exposure with endpoint execution Treat keylogging, remote command execution, and file transfer as one intrusion path and review whether captured credentials could reach admin consoles, VPNs, or service accounts.

Bottom line: The article shows that Remcos is most dangerous when operators can preserve access after the first infection, not simply when they deliver the payload.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →