Executive Summary
A recent campaign utilizes malicious ZIP archives containing VHDX disk images to deliver the Remcos Remote Access Trojan (RAT). The attack targets German-speaking users, as indicated by German-language file naming conventions. Upon mounting the VHDX, a malicious JavaScript file is executed, which initiates a complex, multi-stage infection chain designed to evade EDR and traditional antivirus solutions.
The technical chain moves from JavaScript to PowerShell execution via Windows Management Instrumentation (WMI), followed by the deployment of a reflective .NET loader. This loader eventually injects the Remcos RAT into a legitimate Windows process (backgroundTaskHost.exe). The use of disk images like VHDX is a known but currently less common technique that allows attackers to bypass some first-line email and web gateway filters that may not scan inside virtual disk formats.
This threat highlights the ongoing trend of adversaries using complex process relationships and reflective memory loading to minimize their file-system footprint and evade behavior-based detection rules. Organizations should review their handling of virtual disk formats and monitor for suspicious WMI-to-PowerShell process creation.