Latest posts tagged with #sectoprat on Bluesky
Fake EarthTime installer dropped SectopRAT; operators used SystemBC proxy, Betruger backdoor, AdFind/SharpHound recon, RDP/Impacket lateral moves and exfil via WinSCP to cloud FTP. #ransomware #sectoprat #systembc https://bit.ly/469Rcjz
TAG-150 evolve CastleLoader in CastleRAT con C2 multi-tier: ClickFix, GitHub fraudolenti e payload SectopRAT/WarmCookie colpiscono utenti e aziende.
#CastleLoader #CastleRAT #ClickFix #MaaS #sectoprat #TAG150 #WarmCookie
www.matricedigitale.it/2025/09/05/c...
6/ TAG-150 also deploys other malware families, including #SectopRAT, #WarmCookie, #HijackLoader, and #NetSupportRAT, as well as numerous stealers: #Stealc, #RedLine, #Rhadamanthys, #DeerStealer, #MonsterV2, and more.
An image displaying the URL chain followed to get the initial zip archive downloaded for this infection.
An image displaying the extractioin chain to get the malicious setup files that installed Lumma Stealer.
Traffic from the infection filtered in Wireshark.
SectopRAT persistent on an infected Windows host.
2025-08-15 (Friday): Information from a social media post I wrote for my employer about a #LummaStealer infection leading to #SectopRAT (#ArechClient2). A #pcap of the infection traffc, along with the associated #malware and artifacts are available at www.malware-traffic-analysis.net/2025/08/15/i...
Fake gaming website leading to LummaStealer download
We've observed an interesting infection chain ⛓️ in the wild, starting with #LummaStealer spread through a fake gaming website and resulting in #Latrodectus and #SectopRat 🪲🔍👀
See below for more...
Traffic from an infection filtered in Wireshark.
2025-07-15 (Tuesday): #LummaStealer infection with #SecTopRAT. A #pcap of the #Lumma traffic and #SecTop #RAT activity, the #malware / artifacts from an infection, and the associated IOCs are available at www.malware-traffic-analysis.net/2025/07/15/i...
Hackers Use Leaked Shellter Tool License to Spread Lumma Stealer and SectopRAT Malware reconbee.com/hackers-use-...
#hackers #leakedshelltertool #lummasteale #SectopRAT #malware #malwareattack #cyberattack
Enterprise networks were targeted in a campaign that involved SectopRAT and the deployment of BlackSuit ransomware via a trojanized Zoom installer.
#Ransomware #BlackSuit #SectopRAT #Zoom #Malware
4/7 A previous investigation shows the third-stage domain redirects to kdfmmikfkafjikmfikfjhm[.]com. And the MSI results in the deployment of #SectopRAT
www.inde.nz/blog/i-am-no...
Pivoting on this redirect revealed another downlfkzfoqkajada[.]com
SecTopRAT bundled in Chrome installer distributed via Google Ads
📖
www.malwarebytes.com/blog/news/20...
⚠️
sites[.]google[.]com/view/gfbtechd/
chrome[.]browser[.]com[.]de/GoogleChrome.exe
#malvertising #SecTopRAT
April ACCE Release Notes are live. Check the latest updates at www.ciphertechsolutions.com/acce-release... #ComeBacker #SectopRAT #Cinoshi #SolanStealer
Bing ad for NordVPN leads to SecTopRAT
www.malwarebytes.com/blog/threat-...
#Infosec #Security #Cybersecurity #CeptBiro #BingAd #NordVPN #SecTopRAT
