Loading story…
FortiGuard Incident Response identified a Windows intrusion in which attackers embedded the .NET-based SectopRAT (ArechClient2) remote-access Trojan and infostealer in tampered components of legitimate digital-audio workstation software from an unnamed Italian developer. Investigators found no evidence that the vendor distributed compromised software or that an application vulnerability was exploited; the malware appears to have been inserted after installation on customer systems.
The attackers modified FrameworkBase.dll and placed malicious files under C:\ProgramData, using a scheduled task, DLL side-loading, and in-memory execution to decrypt a payload hidden in a database file. SectopRAT communicates with a hardcoded command-and-control server or fallback domains over AES-encrypted traffic and supports 29 capabilities, including command execution, screen viewing, process and file operations, system restart, and artifact cleanup. An optional WbElevation.dll module steals browser credentials, cookies, payment-card data, application data, email-client and gaming-service information, files, and cryptocurrency-wallet data.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs reported a significant increase in SectopRAT activity.
Elastic Security Labs documented a campaign in which Ghostpulse delivered SectopRAT following a ClickFix social-engineering attack.
AhnLab reported that SectopRAT was distributed through a fake Notion installer.
SectopRAT, also known as ArechClient2, first emerged as a .NET-based remote-access trojan and information stealer.
The altered files, found under C:\ProgramData, used a scheduled task to launch ReportDump.exe and a modified FrameworkBase.dll to load malicious DLLs and decrypt the SectopRAT payload from database files for in-memory execution. The final payload used AES-encrypted C2 traffic, supported 29 commands, and could download WbElevation.dll to steal browser, application, and cryptocurrency-wallet data.
FortiGuard Incident Response investigated a Windows intrusion involving SectopRAT concealed in tampered components associated with digital-audio-workstation software from an unnamed Italian developer. Researchers found no evidence that the vendor distributed compromised software or that a vulnerability in its application was exploited.
Bridewell observed SectopRAT being delivered through a Trojanized EarthTime application.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked an exposed directory on infrastructure in Kazakhstan to a credential-stealing malware operation built around a heavily obfuscated **SectopRAT**/**ArechClient2** variant. The investigation tied suspicious IP overlap to malware samples that unpacked through a multi-stage chain involving legitimate Microsoft-signed binaries, a QSetup-based installer, an AutoIt stage, and a final obfuscated .NET payload. The malware checked for **Avast** and **AVG** processes, reconstructed and launched a legitimate **AutoIt3** executable, injected code into `jsc.exe`, and communicated with command-and-control infrastructure over TCP port `15647`. Recovered functionality and strings indicated the payload fingerprints infected systems and steals credentials and other sensitive data. The campaign was also linked to fake software download pages promoted through **Google Ads**, including a malicious **OBS** installer archive, and researchers estimated the operation may have affected more than **18,000** victims based on files found in the exposed log directory. Separate analysis of newer SectopRAT samples showed the malware had evolved its evasion and communications methods by moving the real command-and-control address out of the class previously used for static extraction, replacing it with `127.0.0.1`, and adding new configuration fields such as a **build ID** and an encryption key for command-and-control traffic. One analyzed sample identified itself as **Build 3**, indicating continued development of the malware family.
Aug 15, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026
Security researchers reported two malware campaigns using fake or trojanized software downloads to install remote access trojans with credential theft and persistence features. eSentire identified a previously undocumented **STX RAT** after an attempted intrusion against a finance-sector organization, where a browser-downloaded VBScript launched a multi-stage loader chain using **XXTEA** and **Zlib** unpacking, anti-analysis checks, and several persistence methods. The malware supports **HVNC**, in-memory payload execution, tunneling, screenshots, security-tool inventory, and theft of browser credentials, cookies, Windows Vault data, FTP client secrets, and cryptocurrency wallets. Its command-and-control design uses **X25519 ECDH**, **Ed25519**, **HKDF-SHA256**, and **ChaCha20-Poly1305** over a custom TCP protocol, with infrastructure reachable over both the clear web and **Tor**. A separate investigation by Breakglass Intelligence found a fake software keygen packaged as a malicious WinRAR self-extracting archive that deployed the **Vjw0rm** JavaScript RAT through a four-layer dropper chain. The infection used nested SFX archives, a compiled AutoHotkey loader, parallel payload paths, and three persistence mechanisms, while abusing `upaste[.]me` as a dead-drop service and hiding the RAT as an XML file later renamed to JavaScript for execution. Researchers said the operator appeared to be a Turkish-speaking commodity cybercrime actor relying on reused tooling, deceptive file paths, and bundled legitimate Windows files to evade detection, underscoring how software cracks, keygens, and trojanized installers remain effective delivery vectors for RATs and infostealers.
Jun 29, 2026