{"version":"1.0","type":"rich","provider_name":"RootPwn","provider_url":"https://rootpwn.me","title":"REMCOS RAT 2024: Watchdog Persistence and Offline Keylogger Mechanisms","description":"The 2024 REMCOS RAT uses a watchdog process to maintain persistence and a low‑profile offline keylogger that writes to a predictable AppData path. Defenders should monitor for injected svchost.exe or rmclient.exe processes, check HKCU\\SOFTWARE\\{MUTEX}\\WD registry entries, and look for keylogger.dat ","url":"https://rootpwn.me/news/remcos-rat-2024-watchdog-persistence-and-offline-keylogger-mechanisms","thumbnail_url":"https://rootpwn.me/images/c0a7fb0f30c241d6b5398dd3d276f652.jpg","thumbnail_width":1600,"thumbnail_height":900}