SectopRAT Variant Discovered in Legitimate Software

• •SectopRAT is hidden in legitimate software, allowing attackers to control compromised systems.
• •The malware was not delivered through a supply chain attack but was added post-installation.
• •Windows users are primarily affected, with a high severity level assigned to this threat.

A variant of the SectopRAT remote access trojan (RAT) has been found embedded in legitimate software from an Italian digital audio company. This multi-stage loader conceals the malware, allowing attackers to gain full remote control of affected Windows systems. The malware, identified by Fortinet's FGIR team, was not delivered through a supply chain attack but rather by tampering with the software post-installation. The SectopRAT payload is encrypted and hidden within a database file, utilizing a legitimate executable to launch it. This incident highlights the risks of trusting widely used applications without monitoring their behavior. There is currently no evidence that the software vendor distributed a compromised version of the software. The attack impacts Windows users, and the severity level is classified as high.