SectopRAT delivered via GPULoader and VMLoader (GPU-based decryption, EtherHiding C2, FakeGuard AitM)

Key facts for SectopRAT GPULoader and VMLoader

Detection coverage for SectopRAT GPULoader and VMLoader

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5534 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: VMLoader/GPULoader DLL Sideloading (libcef.dll / tempdir.dll) from User-Writable Paths — Exploitation Phase

TL-2026-5534 (SectopRAT via VMLoader and GPULoader): detects renamed legitimate executables (jcef_helper.exe, Chrome.exe, DockerDesktop.exe, sslconf.exe) loading libcef.dll (VMLoader, exports the 216 CEF API names without implementing them) or tempdir.dll (GPULoader, masquerading as an IBM SPSS Statistics component) from C:\Users or C:\ProgramData. This is the first code-execution step after a user runs a malvertised fake Claude Desktop, Chrome, Exodus or Docker Desktop installer ZIP. Behaviour-first: no hash or domain dependency, so it survives loader rebuilds. The KQL form also matches the three known loader SHA256 values.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.002, T1036.005, T1204.002
• Data sources: sysmon, DeviceImageLoadEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 earliest=-24h
(ImageLoaded="*\\libcef.dll" OR ImageLoaded="*\\tempdir.dll")
(Image="*\\jcef_helper.exe" OR Image="*\\Chrome.exe" OR Image="*\\DockerDesktop.exe" OR Image="*\\sslconf.exe")
(ImageLoaded="C:\\Users\\*" OR ImageLoaded="C:\\ProgramData\\*")
NOT Image="*\\JetBrains\\*"
| stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as loaded_dll values(Hashes) as hashes by host, User, Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host User Image loaded_dll hashes count

Microsoft KQL

let ioc_dll_sha256 = dynamic(["6b8ecc210ac8a9a22c357bc798e39d4effa3f164b70eb672568738b90b3458f7","6ccd6b67d9b7cb52599e0c9546a2e5d0836b3765e72913b7228e7959688cf3c2","37a82d0c071c7eb36be9a04b0f5a6b2fdb387bf8f08b5e2ac6df2605ebb0f556"]);
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("libcef.dll","tempdir.dll") and InitiatingProcessFileName in~ ("jcef_helper.exe","Chrome.exe","DockerDesktop.exe","sslconf.exe") and (FolderPath startswith @"C:\Users\" or FolderPath startswith @"C:\ProgramData\") and InitiatingProcessFolderPath !contains @"\JetBrains\") or SHA256 in~ (ioc_dll_sha256)
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, FolderPath, SHA256
| order by Timestamp desc

Sigma

title: VMLoader and GPULoader DLL Sideloading via libcef.dll or tempdir.dll
id: 3f6a1c52-8b1e-4d57-9a3e-5e2c7d4b1a01
status: experimental
description: Detects renamed legitimate executables (jcef_helper.exe, Chrome.exe, DockerDesktop.exe, sslconf.exe) loading libcef.dll (VMLoader) or tempdir.dll (GPULoader) from C:\Users or C:\ProgramData, as seen in the TL-2026-5534 SectopRAT delivery chain.
references:
    - https://exatrack.com/publications/sectoprat-gpuloader.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.defense-evasion
    - attack.t1574.002
    - attack.t1036.005
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        ImageLoaded|endswith:
            - '\libcef.dll'
            - '\tempdir.dll'
    selection_img:
        Image|endswith:
            - '\jcef_helper.exe'
            - '\Chrome.exe'
            - '\DockerDesktop.exe'
            - '\sslconf.exe'
    selection_path:
        ImageLoaded|startswith:
            - 'C:\Users\'
            - 'C:\ProgramData\'
    filter_jetbrains:
        Image|contains: '\JetBrains\'
    condition: selection_dll and selection_img and selection_path and not filter_jetbrains
falsepositives:
    - Legitimate Electron or CEF applications installed per-user that ship a libcef.dll next to a renamed helper executable
    - Developer test builds of JCEF applications run from a user profile
level: high

Known false positives:

• Legitimate per-user Electron/CEF applications that ship libcef.dll beside a helper executable named jcef_helper.exe or Chrome.exe
• JetBrains IDE or JCEF developer builds run from a user profile (the JetBrains path is already excluded)

Tuning notes: Add known-good per-user CEF application paths to the NOT clause after a 7-day baseline. Enable Sysmon EventCode 7 for these filenames only (include filter on libcef.dll and tempdir.dll) to keep volume low. Pivot on the Hashes field against the VMLoader/GPULoader SHA256 IOCs in research.json.

• 🔒 Fake Installer Lure Binaries, Homoglyph Executables and sslconf.exe in AppData — Exploitation Phase · unlock with TL Creds
• 🔒 FakeGuard AitM Tooling — Rogue Root CA, Local PAC Proxy 127.0.0.1:8877 and Site Guard Extension — Post-Exploitation · unlock with TL Creds
• 🔒 SectopRAT, FakeGuard and VMLoader Network IOC Match with Community Sibling Infrastructure — C2 · unlock with TL Creds
• 🔒 Defender Exclusion Added for C:\Users via Add-MpPreference (VMLoader and SteamLoader) — Exploitation Phase · unlock with TL Creds
• 🔒 GPULoader Runtime Behaviour — .NET CLR and D3D11/DXGI Loaded by Process in Cisco AnyConnect AppData Folder — Post-Exploitation · unlock with TL Creds
• 🔒 FakeGuard siteguard.exe Child Process and C2 Beacon References ([indicator], /api/device/commands) — C2 · unlock with TL Creds
• 🔒 Loader Persistence — EdgeUpdate Scheduled Task, Loader Run Keys and Cisco AnyConnect Profile Drop — Post-Exploitation · unlock with TL Creds
• 🔒 EtherHiding C2 Resolution — Non-Browser Process Querying BSC RPC (bsc-dataseed) — C2 · unlock with TL Creds

Indicators of compromise for SectopRAT GPULoader and VMLoader

As of 2026-11-09, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-5534.

Sample indicators (3 of 32)

• IP address: 45.59.122[.]85
• Domain: legsotier[.]us
• File hash: 197b6c515cbb9696f3ba1b8a40857189e9de8fc9fa7787fa3e154c9fcf3ea31c

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

Community OSINT corroboration for SectopRAT GPULoader and VMLoader

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How SectopRAT GPULoader and VMLoader works

Initial access is a malvertising lure, active since April 2026, that serves a ZIP posing as a legitimate installer (for example ClaudeDesktop.zip). The ZIP contains a renamed legitimate jcef_helper.exe (also named Chrome.exe or DockerDesktop.exe) and a malicious libcef.dll (VMLoader). VMLoader exports the 216 CEF API names but implements none of them. It first checks the GPU through DXGI and D3D11. It rejects software adapters, VRAM under 256 MB dedicated or 1 GB shared, adapter descriptions shorter than 12 characters, and the vendor IDs 0x1414 (Microsoft Basic Render), 0x1234 (QEMU) and 0x15AD (VMware). It then decrypts an embedded resource (v1: 32-byte XOR; v2: AES-256-CTR through BCrypt) holding 15 modules for a custom stack-based bytecode VM with a 'VMP1' header. The VM resolves kernel32/ntdll APIs by FNV-1a hash. The modules cover Defender emulator detection, ntdll remapping and possible EDR unhooking, clearing of hardware debug registers DR0-DR7, privilege elevation through runas, and a Defender exclusion for C:\Users. They also query a BSC contract and decrypt the returned URL with XOR key deadbeefcafebabe13374269, download a stage-2 ZIP as update.bin, self-install into %APPDATA%\EdgeUpdate-<8hex>\ with Run-key and scheduled-task persistence (MicrosoftEdgeUpdate, onlogon), extract the archive and run every EXE in it, and download and run a legitimate decoy installer chosen by process name. One module matches a process name that uses Cyrillic homoglyphs in 'Chrome.exe'.

The stage-2 ZIP holds the signed sslconf.exe, GPULoader (tempdir.dll, masquerading as an IBM SPSS Statistics component), an encrypted companion file (licence.dat and similar), and optionally siteguard.exe (FakeGuard). GPULoader is sideloaded by sslconf.exe. It repeats the GPU checks, times 16 D3D11 operations (fails above 30 ms) and blocklists FNV-1a hashes of GPU descriptions. It then decrypts the companion file with a D3D11 compute shader (DXBC) that implements AES-256-CTR with a modified MixColumns matrix, so stock AES does not decrypt it. The decrypted container holds VM bytecode for an AMSI bypass (AmsiScanBuffer hooked through a VEH and a hardware breakpoint), a .NET bootstrap (CorBindToRuntime, Assembly.Load) and Run-key persistence, plus the PE32+ .NET SectopRAT assembly. It persists by copying files to %APPDATA%\Cisco AnyConnect Secure Mobility Client\Profile\ and creating a scheduled task through ITaskService.

SteamLoader is an unobfuscated .NET loader with the same behavior and the same BSC contract. It adds the Defender exclusion, uses the mutex Global\WinCacheSyncE and the task CacheMaintenanceTask, and attempts a broken Steam-client-service elevation technique before falling back to runas. FakeGuard (siteguard.exe) is a PyInstaller tool for adversary-in-the-middle attacks on banking and crypto sites. It installs a 'PC Site Guard Local CA' root certificate, sets a PAC proxy to the local proxy 127.0.0.1:8877, and injects JavaScript. It also installs a malicious Chrome MV3 extension named 'Site Guard', adds Run-key persistence, and beacons to /api/device/commands, where it can run cmd.exe /c. Its Russian-language docstrings describe balance sniffing, session-cookie theft and IBAN/BTC/ETH beneficiary substitution. Its default target is schwab.com. A remote routing config from 45.59.122.85/routing/ covers a much wider list of banking, crypto, payment, and security and update domains. Its C2 is the hardcoded IP 45.59.122.85, or contract 0xc6a3, which stores cleartext URLs and was updated five times between 2026-10-13 and 2026-10-23.

The final payload is SectopRAT, an ArechClient2 variant similar to the one Fortinet documented. It steals Chromium and Gecko credentials, cookies, app-bound encryption keys and payment cards. It also takes data from about 30 wallet extensions, Steam, Discord, Telegram, FileZilla, Battle.net and VPN clients. It profiles hosts through WMI. It has about 35 Receive* RAT commands (shell, file and process managers, screen capture, hidden desktop, keylogger, plugin module RLib) and self-deletes through cmd /C choice. Its separate BSC channel, contract 0xe012 (created 2025-05-30), had 22 C2 rotations between May 2025 and July 2026, and a companion contract 0xfdf3 holds encrypted blocks. ExaTrack assesses a single operator that does not sell the tools, very likely the same actor as Arctic Wolf's GPUGate (shared TTPs and C2 ranges 107.189/16, 45.59/16 and 104.194/16, but unconfirmed). It judges that FakeGuard, its C2 and SteamLoader were probably LLM-generated. It links the funding wallets to a Binance-funded (KYC) wallet, 0x39a9, as an OPSEC lead. Severity is analyst-assigned; the source gives no CVE or CVSS.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1574.001 DLL; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task; T1176.001 Browser Extensions; T1547.001 Registry Run Keys / Startup Folder

Collection

T1056.001 Keylogging; T1113 Screen Capture

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Command and Control

T1102.001 Dead Drop Resolver

Privilege Escalation

T1134.002 Create Process with Token

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1557 Adversary-in-the-Middle

defense-impairment

T1553.004 Install Root Certificate; T1685 Disable or Modify Tools

Resource Development

T1583.008 Malvertising

Impact

T1657 Financial Theft

Remediation for SectopRAT GPULoader and VMLoader

Immediate actions

• Block the VMLoader staging domains, the FakeGuard C2 IPs and the SectopRAT C2 IPs listed in the IOCs at the perimeter
• Alert on bsc-dataseed*.binance.org DNS/HTTPS traffic from hosts with no legitimate crypto or Web3 context
• Hunt for %APPDATA%\EdgeUpdate-*, the Cisco AnyConnect Profile folder under %APPDATA% containing sslconf.exe and tempdir.dll, and %LOCALAPPDATA%\SiteGuard
• Hunt for a 'PC Site Guard Local CA' root certificate and a PAC proxy pointing at 127.0.0.1:8877, and remove them
• Reset credentials and revoke sessions for any user on an infected host, and move crypto-wallet assets to new wallets

Workarounds

• Enable Defender tamper protection and ASR rules
• Block unsigned or newly seen DLLs sideloaded by signed executables running from user-writable paths

Longer-term hardening

• Restrict software downloads to vetted vendor sites and package managers, and warn users about sponsored search results for Claude Desktop, Chrome, Exodus and Docker Desktop
• Alert on Defender exclusions added for C:\Users and on tamper-protection events
• Alert on scheduled tasks at the root of the task tree with system-lookalike names and on Run keys with the names listed in the IOCs
• Alert on jcef_helper.exe running outside its JetBrains folder, and on executables or DLLs with Cyrillic homoglyph names

Affected and fixed versions

• Microsoft — Windows (end-user and IT workstations)
  Vulnerable versions: Windows systems with a real GPU where the user runs a trojanized installer

Timeline of SectopRAT GPULoader and VMLoader

• 2022-05-08 BSC wallet 0x39a9 is created and funded by a Binance hot wallet (KYC); ExaTrack later flags it as an OPSEC lead linked to the SectopRAT funding network.
• 2025-04-04 Wallet 0x39a9 receives ChangeNOW funds and forwards some to funnel hub 0xa6ab.
• 2025-05-07 Wallet 0x39a9 creates a valid SectopRAT contract, and gas hub 0x2a0d creates two test wallets with contracts 'TestBlabla' and 'dsfdsfsdfsdfsdfsdfsdfsdf'.
• 2025-05-30 SectopRAT C2 resolver contract 0xe012 is created by wallet 0xb57d.
• 2026-04-01 VMLoader/GPULoader malvertising campaign is active (April 2026; exact day not stated).
• 2026-05-28 VMLoader C2 resolver contract 0xc190 is created at 11:36:38 UTC by wallet 0x3695.
• 2026-05-30 Oldest SectopRAT samples (May 2026; exact day not stated) install a malicious 'Google Docs' browser extension that logs visited URLs and input-field changes.
• 2026-07-01 SectopRAT contract 0xe012 had 22 C2 rotations by July 2026 (May 2025 to July 2026). Huntress publishes a related report (FakeAgent) the same month.
• 2026-10-13 FakeGuard C2 contract 0xc6a3 begins five URL updates (through 2026-10-23); VMLoader contract 0xc190 had six URL updates between 2026-05-28 and 2026-10-23.
• 2026-10-23 Last observed FakeGuard and VMLoader contract updates in the ExaTrack data.
• 2026-11-05 ExaTrack publishes 'SectopRat's GPULoader and VMLoader', which assesses a single operator and likely overlap with GPUGate.

Sources cited for SectopRAT GPULoader and VMLoader

• SectopRat's GPULoader and VMLoader - ExaTrack exatrack.com · Research · 2026-11-05
• SectopRat's GPULoader and VMLoader - Malpedia library entry malpedia.caad.fkie.fraunhofer.de · Research · 2026-11-05
• GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe - Arctic Wolf arcticwolf.com · Research · 2025-09-09
• Ongoing malvertising campaign targets European IT workers with fake GitHub Desktop installers - Help Net Security Help Net Security · News · 2025-09-09
• SectopRAT Returns, Hiding Inside a Legitimate Application - Dark Reading (Fortinet ArechClient2 variant) Dark Reading · News · 2026-09-24

More in malware

• Recorteiro: Rust banking trojan with 'Recort' screen-hole overlay fraud distributed via fake EnergiaLusa electricity bills in Portugal
• NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-Control
• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982