SectopRAT (Malware): news timeline & CVEs

Fortinet Uncovers SectopRAT Variant Hidden Inside Tampered Legitimate Windows Software

Fortinet found SectopRAT hidden in tampered Italian audio software, using DLL tampering, scheduled tasks, and in-memory loading for remote control and credential theft.

FortiGuard Incident Response identified a SectopRAT (ArechClient2) variant on a compromised device, concealed inside a tampered legitimate digital audio workstation from an Italian developer. A modified FrameworkBase.dll imported a malicious component launched via Windows Task Scheduler, which decrypted assembly code from database files, dynamically resolved 187 Windows functions, and loaded the 64-bit payload entirely in memory. The RAT supports 29 commands including screen capture and remote shell, steals browser passwords, cookies, card data, Thunderbird data, and cryptocurrency wallet data, and uses AES-encrypted C2 with 12 backup endpoints including Binance BSC dataseed nodes. Fortinet found no evidence the developer distributed compromised software, pointing to file tampering rather than a confirmed supply-chain breach.

Cyber Security News08:13 UTC · 14h agoMalware in the wild

SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets

SectopRAT hides in tampered legitimate software and steals browser credentials and crypto wallets.

FortiGuard analyzed a SectopRAT campaign, also known as ArechClient2, hidden in a tampered installation of legitimate digital-audio software from an Italian vendor. Investigators found no evidence of a vendor-distributed trojan or supply-chain compromise; the malicious folder was placed under C:\ProgramData after installation. A scheduled ReportDump.exe loads FrameworkBase.dll, whose import table was altered to pull in the sdkcra.dll loader, which decrypts the .NET RAT in memory. The malware contacts 98.142.252.140 on TCP port 15847 using AES-encrypted JSON commands, supports 29 functions including screen capture and shell execution, and its DeployBrowserKey module steals browser credentials, cookies, payment data, and cryptocurrency wallets.

GBHackers05:33 UTC · 17h agoMalware in the wild 2 sources

SectopRAT Returns, Hiding Inside a Legitimate Application

SectopRAT has resurfaced, hiding inside legitimate applications to evade trust-based defenses.

Dark Reading reports renewed activity from SectopRAT, a remote access Trojan that conceals itself inside a legitimate application. Experts say the activity shows why organizations should monitor how applications behave rather than trusting them solely because they look legitimate. The report does not name victims, exploit details, or CVE identifiers.

Dark ReadingSep 24, 20:32 UTC · 6d agoMalware in the wild

SectopRAT

Timeline3 articles

Appears with

Fortinet Uncovers SectopRAT Variant Hidden Inside Tampered Legitimate Windows Software

SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets

SectopRAT Returns, Hiding Inside a Legitimate Application