SectopRAT Variant Exploits Legitimate Software for Remote Control Attacks

• •SectopRAT is embedded in legitimate software, allowing for stealthy attacks.
• •The malware uses a multi-stage loader to execute its payload on Windows systems.
• •No evidence suggests the software vendor was compromised; the attack involved tampering with legitimate files.

A new variant of the SectopRAT remote access Trojan (RAT) has been discovered embedded in legitimate software from an Italian digital audio company. This multi-stage attack allows attackers to gain full remote control of Windows systems by concealing the malware within modified application components. The malware is activated through a tampered executable that utilizes Windows Task Scheduler to launch a malicious DLL, which decrypts and executes the SectopRAT payload. Affected users are primarily Windows users, with no evidence indicating that the software vendor distributed a compromised version. The attack highlights the risks of trusting legitimate applications without monitoring their behavior. The investigation is ongoing, with FortiGuard Incident Response leading the analysis. The malware has a history of disguising itself in various legitimate software to evade detection.