[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKGQRFBWt3JuEvOH8wStoXobDsKgMR4RmnfxdYCYgcp4":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"502582ae-0493-45e9-8c07-aaa730444dc7","SectopRAT Abuses Legitimate Audio Software Files to Steal PC Data","sectoprat-abuses-legitimate-audio-software-files-to-steal-pc-data-b7bb22","FortiGuard found SectopRAT hidden in modified audio software files, using staged loading to steal browser data and remotely control infected Windows PCs.","Attackers are distributing a variant of the SectopRAT malware by embedding it within modified components of legitimate digital audio software. This multi-stage infection chain, discovered by FortiGuard, uses Windows Task Scheduler and other legitimate system processes to load the malicious payload, making it harder to detect. Once active, SectopRAT can steal browser data, execute commands remotely, and capture screenshots.","SectopRAT variant hidden in modified audio software files steals PC data and enables remote control.","https:\u002F\u002Fhackread.com\u002Fsectoprat-abuses-audio-software-steal-pc-data\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fsectoprat-abuses-audio-software-steal-pc-data.jpg","2026-09-25T10:43:28+00:00","2026-09-25T12:00:09.483143+00:00",8,[17,20,23,25],{"name":18,"type":19},"Windows","product",{"name":21,"type":22},"Digital Audio Workstation","technology",{"name":24,"type":22},"Task Scheduler",{"name":26,"type":22},"DLL","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"ip","98.142.252.140","Primary C2 server IP address",[18],{"controls":57,"vendors":134},[58,79,105],{"slug":59,"name":60,"problem":61,"products":62},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[63,71],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":80,"name":81,"problem":82,"products":83},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":101,"product_name":102,"url":103,"description":104},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[135],{"slug":136,"name":137,"logo_path":138,"roles":139},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[140],"reported_by",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":157},"sectoprat-hides-inside-legitimate-audio-software-to-steal-data","SectopRAT Hides Inside Legitimate Audio Software to Steal Data","Attackers are exploiting user trust in legitimate software by embedding SectopRAT malware within modified components of genuine digital audio applications, a technique known as trojanizing. The multi-stage infection chain leverages trusted Windows system tools like Task Scheduler to execute the malicious payload, effectively bypassing conventional detection methods. Once deployed, SectopRAT can harvest browser credentials, capture screenshots, and accept remote commands — creating significant data exposure risk. This attack highlights the danger of downloading software from unverified sources and the need for robust behavioral monitoring to catch abuse of legitimate system processes.",[146,147,148,149,150,151,152,153,154,155,156],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SA-12: Supply Chain Protection","MITRE ATT&CK T1053.005: Scheduled Task","MITRE ATT&CK T1574: Hijack Execution Flow","GDPR Article 32: Security of Processing",{}]