Unrecom phishing campaign hit high-profile entities globally

Security Experts at Fidelis Cyber Security firm have recently discovered a new phishing campaign using the Unrecom RAT (remote access trojan).

Fidelis Cyber Security firm has recently issued the Fidelis Threat Advisory #1013 to detail a phishing campaign using the Unrecom RAT (remote access trojan).

Experts at Fidelis during the last two weeks have observed an increase in attack activity, based on this malicious agent, against the US and local government, technology, advisory services, health, and financial. The campaign also hit the financial industry in Saudi Arabia and Russia.

The Unrecom remote access tool was spread as attachments of phishing emails try to trick the users into thinking the emails are legitimate. Following a list of names used for the attachment in the phishing campaign:

  • The  Payment Invoice.jar
  • Payment details.jar
  • POR#94586.zip/POR#94586.jar
  • INV#94586.zip/INV#94586.jar
  • Invitation.jar
  • reports-pdf.jar
  • US$25k.jar,
  • DBC_BANK_IMG_23456_156.jar
  • lremit_Transfer_Error_Page.jar.

The Unrecom is a multi-platform Java-based remote access tool has a low detection rate, it goes undetected by most AntiVirus solutions.  Last version of this RAT is 3.2 and is being sold at “unrecom[.]net” for $500  (Enterprise Version) and $200 (Full Version).

“The evolution of Unrecom RAT dates from its beginnings as a tool known as Frutas RAT, subsequently branded as Adwind RAT, and now Unrecom RAT. In 2013, it was reported that Frutas RAT was used in phishing email campaigns against high profile companies in Europe and Asia in sectors such as finance, mining, telecom, and government.” states the advisory.


As many other remote access tools also Unrecom RAT provides basic features to gain remote control over the victims:

  • Collection of System Information (e.g. IP, OS version, memory RAM information, Java version, Computer Name, User account compromised, etc.)
  • Upload & Execute additional malware, typically exploiting vulnerabilities derived from collected system information
  • Capture Webcam and Microphone, without user notification
  • Remote Desktop to watch user activity
  • File Manager allowing access to files in the context of the current user
  • Browser Password theft
  • Keylogging to capture passwords otherwise obscured from viewing

The advisory reveals that Command & Control (CnC) servers used by the Unrecom RAT in this campaign were used in the past by variants of the DarkComet and AcromRAT malware which have been observed in large volumes in the Middle East.

Following the list of indicators provided in the advisory … be aware!


Pierluigi Paganini

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.


10th Anniversary Exclusive Top 100 CISO Conference & Innovators Showcase