RemCom

RemCom is an open-source remote command execution utility for Windows that serves as a PsExec-like replacement, allowing operators to execute processes on remote systems through service-based execution. It is best characterized as a legitimate dual-use administrative tool that is frequently repurposed by threat actors for lateral movement and post-compromise operations inside Windows environments. Observed malicious use includes remote execution of encoded PowerShell commands, deployment of additional payloads, and propagation across compromised enterprise networks.

RemCom has appeared in intrusion activity associated with multiple threat actors and operations, including APT39, Mango Sandstorm (formerly tracked by Microsoft as MERCURY), Stately Taurus, and reporting on FANCY BEAR tradecraft. It has also been referenced in destructive and ransomware-related operations as an auxiliary tool used after initial compromise, including BlackCat/ALPHV-linked activity and environments later impacted by IsaacWiper. In these contexts, RemCom is typically not the initial payload but a post-exploitation utility used to extend access, execute tooling remotely, and support movement between hosts.

Operationally, RemCom is commonly associated with creation of temporary or attacker-controlled Windows services to launch commands on remote hosts, making it relevant to service-execution and remote-service-creation detections. Because it is openly available and can be used legitimately by administrators, detections require contextual analysis to distinguish benign administration from adversary tradecraft. Its repeated use across espionage, ransomware, and destructive campaigns has made RemCom a well-known indicator of hands-on-keyboard lateral movement in Windows enterprise intrusions.