> From a VHDX File to a Remcos RAT, (Tue, Jun 16th)

[SOURCE] SANS ISC [DATE: 16/06/2026 07:09] [LANGUAGE: EN]

Yesterday, a reader reported to us a malicious ZIP archive (SHA256: a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094[1]). Once unzipped, it contains a VHDX file that discloses a malicious JavaScript after being mounted (which is automatic on modern Windows OSs):

[messages.read_original_source] →