SectopRAT Returns, Hiding Inside a Legitimate Application

Fortinet researchers found a variant of the SectopRAT .NET RAT and infostealer concealed within a tampered copy of a legitimate Italian audio application; the adversary embedded an encrypted payload inside application files and used a DLL-loading mechanism to launch it. The malware offers extensive information-stealing and remote-control capabilities (29 identified actions), uses AES-encrypted network traffic to communicate with attacker infrastructure, and exemplifies a delivery TTP that abuses trusted software to evade detection.