SectopRAT Abuses Legitimate Audio Software Files to Steal PC Data

FortiGuard Incident Response discovered a multi-stage attack in which attackers tampered with components of a legitimate digital audio workstation to load a SectopRAT variant on a Windows host; the chain used a scheduled task to run ReportDump.exe, a modified FrameworkBase.dll that sideloaded a malicious sdkcra.dll, and decrypted and executed a .NET SectopRAT payload that connects to hardcoded C2 (98.142.252.140:15847) and backup domains, supports 29 operator commands (including screen capture, file/process management, remote execution), and can deploy a WbElevation.dll module to harvest browser credentials, wallets and other sensitive data.