FORTINET researchers have identified a variant of the SectopRAT remote access Trojan (RAT) and infostealer concealed within legitimate software from an Italian digital-audio company. FortiGuard Labs said the attackers appear to have tampered with the application after it was installed on customers’ systems, rather than compromising the software vendor. They modified the legitimate `FrameworkBase.dll` file to load the malware, which was encrypted and embedded in a database file.
Fortinet researcher Xiaopeng Zhang said there was no evidence that the company’s software was specifically targeted or that a vulnerability in it was exploited.
Also known as ArechClient2, SectopRAT is an obfuscated .NET-based malware first seen in early 2019. It provides remote-control functions and can steal browser credentials, cookies, files, saved payment information and data linked to email, gaming and cryptocurrency services. Fortinet identified 29 actions, including manipulating files and processes, viewing the screen, running commands, restarting the machine and removing malicious components.
The malware communicates with attacker-controlled infrastructure using encrypted traffic; unlike an earlier variant, which began with unencrypted traffic, this version uses AES encryption from the outset.
The campaign reinforces concerns about attackers abusing the reputation of trusted applications to evade scrutiny. Security experts quoted by Dark Reading said defenders should assess whether software behaves as expected and restrict what it can access, rather than relying solely on an application’s name or apparent legitimacy. The report does not establish how many organisations or systems were affected, nor does it confirm exploitation of the vendor’s software supply chain.