Remcos C2 via backgroundTaskHost

Ethan Andrews@eandrews

•updated Jun 16, 2026•5•0•10

Detects network connections initiated by 'backgroundTaskHost.exe' to known Remcos C2 infrastructure, specifically targeting 'duckdns.org' or communicating over port 53552. This rule aims to identify potential Remcos RAT activity.