Mapping Remcos RAT C2 Activity and Associated Communication Ports

Remcos, a commercial remote access tool distributed by Breaking-Security and marketed as “Remote Administration Software,” continues to pose a significant threat to organizations worldwide.

Despite its administrative positioning, the tool’s capabilities are routinely weaponized for unauthorized access and data theft, with recent analysis revealing extensive C2 infrastructure operating across multiple continents.

Recent Censys research tracking Remcos command-and-control (C2) servers between October 14 and November 14, 2025, identified over 150 actively operational C2 servers, underscoring the tool’s sustained adoption by threat actors.

The analysis reveals a sophisticated yet predictable deployment pattern that highlights both the scale of Remcos abuse and the opportunities for defensive detection and mitigation.

Remcos communicates with its C2 infrastructure primarily through HTTP and HTTPS channels, utilizing a distinct set of ports that facilitate identification and tracking.

The default port 2404 remains the most commonly deployed configuration, accounting for the majority of observed C2 servers.

However, operators demonstrate deployment flexibility by utilizing alternative ports including 5000, 5060, 5061, 8268, and 8080, with additional use of standard ports 80 and 443 to blend with legitimate traffic.

This port diversity presents both challenges and opportunities for network defenders. While standard ports like 80 and 443 complicate detection by mimicking legitimate web traffic, the concentration of Remcos infrastructure on non-standard ports enables security teams to implement targeted detection signatures.

Network intrusion detection systems can leverage the tool’s characteristic encoded POST bodies and atypical TLS settings to identify malicious beacons.

Global Infrastructure Distribution

The geographic distribution of Remcos C2 infrastructure reflects a strategic reliance on inexpensive, lightly vetted hosting providers.

Censys tracking identified significant hosting concentration in the United States, the Netherlands, and Germany, with secondary clusters in France, the United Kingdom, Turkey, and Vietnam.

This geographic diversity complicates attribution and enforcement efforts while providing operators with redundancy.

Infrastructure providers such as COLOCROSSING, RAILNET, and CONTABO account for a substantial share of observed Remcos hosting, consistent with the threat actors’ preference for commodity services offering minimal abuse oversight.

The continued expansion in European hosting, particularly among smaller providers, suggests operators are actively diversifying their infrastructure footprint to reduce takedown risk.

Remcos establishes persistence on compromised systems through Scheduled Tasks or Run-key entries, maintaining stable access after initial compromise.

Certificate analysis reveals template-based configuration practices, with SSL/TLS certificates frequently reused across multiple IP addresses. This pattern enables cluster linkage and indicates minimal obfuscation in operator deployment workflows.

A concerning subset of Remcos C2 hosts exposed additional services including Server Message Block (SMB) and Remote Desktop Protocol (RDP), suggesting operators maintain direct control infrastructure alongside automated deployment mechanisms.

Threat Assessment and Recommendations

The combination of remote command execution, file transfer, keylogging, and credential collection capabilities makes Remcos a high-priority target for network monitoring and endpoint detection.

Implementing application allowlisting, restricting Scheduled Task creation, and monitoring HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry modifications provide crucial detection layers.

Infrastructure turnover analysis reveals mixed patterns, with some servers persisting for weeks or months while others rotate rapidly, complicating long-term blocking efforts.

Organizations should prioritize monitoring for HTTP/HTTPS beacons on ports 2404, 5000, 5060, 5061, 8268, and 8080.

The predictability of Remcos deployments offers defenders actionable intelligence for proactive threat mitigation.This hybrid approach provides operational flexibility while reducing dependency on fully computerized frameworks.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.