A new SectopRAT variant has been detected within compromised Windows software, enabling attackers to remotely control infected machines and steal sensitive data. While there is no concrete evidence of the developer distributing compromised software, the findings suggest tampering with legitimate files rather than a confirmed breach of the vendor's supply chain. Here, encryption, indirect calls, and multiple loading stages made the working payload less conspicuous than a standalone malicious executable sitting openly in an application folder.

Researchers identified 29 commands that allowed for screen capture, remote shell access, file and process management, and other administrative actions that effectively controlled the device remotely.

A single command resulted in the download of an additional browser extraction module, allowing the malware to collect sensitive information such as saved passwords, associated website addresses, autofill records, payment-card details, and cookies. Fortinet suggests cybersecurity awareness training to help users identify phishing and other suspicious content, along with seeking incident-response support when a compromise is suspected. Backup endpoints for recovery of controller addresses are available at the following URLs:

  • hxxps://bsc-dataseed2.binance[.]org/
  • hxxps://bsc-dataseed3.binance[.]org/
  • hxxps://bsc-dataseed4.binance[.]org/
  • hxxps://bsc-dataseed1.defibit[.]io/
  • hxxps://bsc-dataseed2.defibit[.]io/ Backup endpoints for recovery of controller addresses are available at the following URLs:
  • hxxps://bsc-dataseed3.defibit.io/
  • hxxps://bsc-dataseed4.defibit.io/
  • hxxps://bsc-dataseed1.ninicoin.io/
  • hxxps://bsc-dataseed2.ninicoin.io/
  • hxxps://bsc-dataseed3.ninicoin.io/ Backup endpoint: hxxps://bsc-dataseed4.ninicoin.io/ Fallback endpoint for recovering a controller address; no compromise yet.