Fake RVTools installer uses Sectigo cert to deliver Python RAT

A recent cybersecurity alert highlights a sophisticated espionage campaign targeting virtualization administrators through a fake RVTools installer. This malicious payload uses a valid Sectigo code-signing certificate to bypass security measures, allowing it to install a Python RAT (Remote Access Trojan) undetected. The attack follows a multi-stage routine beginning with a Visual Basic script that obscures its code and launches a hidden PowerShell script to retrieve more malicious components from external sources.

The malware conducts extensive reconnaissance within the target network and maintains stealthy communication channels with the threat actors. To mitigate such threats, organizations are urged to employ advanced monitoring techniques and behavioral threat hunting, focusing on registry entries and PowerShell activities, to defend against unauthorized software installations.