SectopRAT Variant Hidden in Legitimate Italian Audio Software
Summary
Fortinet found a SectopRAT variant concealed in a tampered copy of an Italian audio application. The malware is loaded through a modified DLL and can remotely control infected systems and steal sensitive data.
Key points
- Fortinet says attackers appear to have added the RAT after the legitimate application was installed; it found no evidence the vendor was compromised or a software vulnerability exploited.
- The malware payload is encrypted and embedded in a database file, with a tampered FrameworkBase.dll used to load it.
- SectopRAT, also known as ArechClient2, can control infected systems, manipulate files and processes, run commands, and view victims' screens.
- It can steal browser credentials, cookies, saved payment information, and data from email, gaming, and cryptocurrency applications.
- The analyzed variant uses AES-encrypted network traffic, unlike a previously observed version that began with unencrypted traffic.
- Researchers and security professionals emphasize monitoring whether applications behave as expected and limiting their privileges.
Article Details
- Attack Vectors
- A tampered copy of a legitimate Italian digital-audio application was used to conceal SectopRAT; the operators appear to have added the RAT after the application was installed, without evidence of vendor compromise or exploitation of a software vulnerability.
- The malware was encrypted and embedded in a database file, with a legitimate-looking executable and DLL-loading mechanism used to launch it.
- SectopRAT has also been delivered in reported campaigns via malicious advertising, SEO poisoning, ClickFix scams, and fake or Trojanized installers.
- Defensive Notes
- Monitor application behavior for activity inconsistent with the application's legitimate purpose rather than trusting software solely because it appears legitimate.
- Limit and review the privileges and resources available to endpoint software.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes SectopRAT as heavily obfuscated and says its payload was encrypted and embedded in a database file.T1056.003 · Web Portal CaptureSectopRAT searches browsers and other applications for credentials and account data.T1059 · Command and Scripting InterpreterSectopRAT can run commands on the infected system.T1070.004 · File DeletionSectopRAT can delete malicious components to conceal signs of its activity.T1113 · Screen CaptureFortinet reported that SectopRAT can view the victim's screen.T1568 · Dynamic ResolutionThe malware connects to attacker-controlled infrastructure using encrypted traffic.T1574.002 · DLL Side-LoadingThe report says the tampered FrameworkBase.dll was used to secretly load the SectopRAT payload.
People
Len NoeSolutions architect at BeyondTrust who commented on software privileges and trust.Robert ColesSenior manager of threat intelligence at Black Duck who commented on monitoring application behavior.Xiaopeng ZhangFortiGuard Labs researcher who authored the report and discussed the SectopRAT campaign.
Malware
ArechClient2SectopRAT, also known as ArechClient2, is a heavily obfuscated .NET-based malware that combines remote-control capabilities with extensive information-stealing functionality, including the theft of browser credentials,GHOSTPULSEFor example, in 2025, Elastic Security Labs documented a campaign in which a threat actor used the Ghostpulse malware loader to deliver SectopRAT following a ClickFix social-engineering attack.SectopRATResearchers discovered a variant of the SectopRAT post-compromise backdoor and infostealer hidden inside legitimate software from an Italian digital-audio company.
Vendors
AhnLabIn 2024, AhnLab reported seeing a threat actor distribute SectopRAT through a fake Notion installer, and more recently Bridewell said it observed an attacker delivering SectopRAT through a Trojanized version of theBeyondTrustbe hidden, but what privileges are available to it upon arrival, says Len Noe, solutions architect at BeyondTrust. "Hiding malware inside trusted software works because trust granted by reputation is trust an attackerBlack Duckbecause it is legitimate, according to Robert Coles, senior manager of threat intelligence at Black Duck. "The takeaway isn't the malware; it's the delivery method," Coles says. Users are trained to avoidBridewellreported seeing a threat actor distribute SectopRAT through a fake Notion installer, and more recently Bridewell said it observed an attacker delivering SectopRAT through a Trojanized version of the EarthTimeElasticFor example, in 2025, Elastic Security Labs documented a campaign in which a threat actor used the Ghostpulse malware loader to deliver SectopRAT following a ClickFix social-engineering attack.Fortinetapplication was installed on customer systems rather than by compromising the software vendor itself, Fortinet said in a report this week based on its analysis of the threat. The campaign shows how attackers can
Products
Claude DesktopSectopRAT has a history of disguising itself as legitimate software, such as the Notion installer and Claude Desktop," Zhang says, pointing to previous campaigns involving the malware.EarthTimeBridewell said it observed an attacker delivering SectopRAT through a Trojanized version of the EarthTime application.Notionthe SectopRAT payload. SectopRAT has a history of disguising itself as legitimate software, such as the Notion installer and Claude Desktop," Zhang says, pointing to previous campaigns involving the malware.