# SectopRAT delivered via GPULoader and VMLoader (GPU-based decryption, EtherHiding C2, FakeGuard AitM)

> ExaTrack documents a single-operator crimeware ecosystem that delivers the SectopRAT (ArechClient2) stealer/RAT through two loaders, VMLoader (libcef.dll) and GPULoader (tempdir.dll), plus SteamLoader and the FakeGuard AitM banking tool. Delivery is by malvertising of fake Claude Desktop, Chrome, Exodus and Docker Desktop installers, and C2 is resolved through Binance Smart Chain contracts (EtherHiding).

- **Published:** 2026-11-09T08:41:34Z
- **Last reviewed:** 2026-11-09T08:41:34Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5534
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5534.png
- **ID:** TL-2026-5534
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)

## Description

Initial access is a malvertising lure, active since April 2026, that serves a ZIP posing as a legitimate installer (for example ClaudeDesktop.zip). The ZIP contains a renamed legitimate jcef_helper.exe (also named Chrome.exe or DockerDesktop.exe) and a malicious libcef.dll (VMLoader). VMLoader exports the 216 CEF API names but implements none of them. It first checks the GPU through DXGI and D3D11. It rejects software adapters, VRAM under 256 MB dedicated or 1 GB shared, adapter descriptions shorter than 12 characters, and the vendor IDs 0x1414 (Microsoft Basic Render), 0x1234 (QEMU) and 0x15AD (VMware). It then decrypts an embedded resource (v1: 32-byte XOR; v2: AES-256-CTR through BCrypt) holding 15 modules for a custom stack-based bytecode VM with a 'VMP1' header. The VM resolves kernel32/ntdll APIs by FNV-1a hash. The modules cover Defender emulator detection, ntdll remapping and possible EDR unhooking, clearing of hardware debug registers DR0-DR7, privilege elevation through runas, and a Defender exclusion for C:\Users. They also query a BSC contract and decrypt the returned URL with XOR key deadbeefcafebabe13374269, download a stage-2 ZIP as update.bin, self-install into %APPDATA%\EdgeUpdate-<8hex>\ with Run-key and scheduled-task persistence (MicrosoftEdgeUpdate, onlogon), extract the archive and run every EXE in it, and download and run a legitimate decoy installer chosen by process name. One module matches a process name that uses Cyrillic homoglyphs in 'Chrome.exe'.

The stage-2 ZIP holds the signed sslconf.exe, GPULoader (tempdir.dll, masquerading as an IBM SPSS Statistics component), an encrypted companion file (licence.dat and similar), and optionally siteguard.exe (FakeGuard). GPULoader is sideloaded by sslconf.exe. It repeats the GPU checks, times 16 D3D11 operations (fails above 30 ms) and blocklists FNV-1a hashes of GPU descriptions. It then decrypts the companion file with a D3D11 compute shader (DXBC) that implements AES-256-CTR with a modified MixColumns matrix, so stock AES does not decrypt it. The decrypted container holds VM bytecode for an AMSI bypass (AmsiScanBuffer hooked through a VEH and a hardware breakpoint), a .NET bootstrap (CorBindToRuntime, Assembly.Load) and Run-key persistence, plus the PE32+ .NET SectopRAT assembly. It persists by copying files to %APPDATA%\Cisco AnyConnect Secure Mobility Client\Profile\ and creating a scheduled task through ITaskService.

SteamLoader is an unobfuscated .NET loader with the same behavior and the same BSC contract. It adds the Defender exclusion, uses the mutex Global\WinCacheSyncE and the task CacheMaintenanceTask, and attempts a broken Steam-client-service elevation technique before falling back to runas. FakeGuard (siteguard.exe) is a PyInstaller tool for adversary-in-the-middle attacks on banking and crypto sites. It installs a 'PC Site Guard Local CA' root certificate, sets a PAC proxy to the local proxy 127.0.0.1:8877, and injects JavaScript. It also installs a malicious Chrome MV3 extension named 'Site Guard', adds Run-key persistence, and beacons to /api/device/commands, where it can run cmd.exe /c. Its Russian-language docstrings describe balance sniffing, session-cookie theft and IBAN/BTC/ETH beneficiary substitution. Its default target is schwab.com. A remote routing config from 45.59.122.85/routing/ covers a much wider list of banking, crypto, payment, and security and update domains. Its C2 is the hardcoded IP 45.59.122.85, or contract 0xc6a3, which stores cleartext URLs and was updated five times between 2026-10-13 and 2026-10-23.

The final payload is SectopRAT, an ArechClient2 variant similar to the one Fortinet documented. It steals Chromium and Gecko credentials, cookies, app-bound encryption keys and payment cards. It also takes data from about 30 wallet extensions, Steam, Discord, Telegram, FileZilla, Battle.net and VPN clients. It profiles hosts through WMI. It has about 35 Receive* RAT commands (shell, file and process managers, screen capture, hidden desktop, keylogger, plugin module RLib) and self-deletes through cmd /C choice. Its separate BSC channel, contract 0xe012 (created 2025-05-30), had 22 C2 rotations between May 2025 and July 2026, and a companion contract 0xfdf3 holds encrypted blocks. ExaTrack assesses a single operator that does not sell the tools, very likely the same actor as Arctic Wolf's GPUGate (shared TTPs and C2 ranges 107.189/16, 45.59/16 and 104.194/16, but unconfirmed). It judges that FakeGuard, its C2 and SteamLoader were probably LLM-generated. It links the funding wallets to a Binance-funded (KYC) wallet, 0x39a9, as an OPSEC lead. Severity is analyst-assigned; the source gives no CVE or CVSS.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1176.001 Browser Extensions
- T1134.002 Create Process with Token
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1497.001 System Checks
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1027.013 Encrypted/Encoded File
- T1553.004 Install Root Certificate
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1113 Screen Capture
- T1102.001 Dead Drop Resolver
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**VMLoader/GPULoader DLL Sideloading (libcef.dll / tempdir.dll) from User-Writable Paths — Exploitation Phase** (`TL-2026-5534-SPL-001`)

TL-2026-5534 (SectopRAT via VMLoader and GPULoader): detects renamed legitimate executables (jcef_helper.exe, Chrome.exe, DockerDesktop.exe, sslconf.exe) loading libcef.dll (VMLoader, exports the 216 CEF API names without implementing them) or tempdir.dll (GPULoader, masquerading as an IBM SPSS Statistics component) from C:\Users or C:\ProgramData. This is the first code-execution step after a user runs a malvertised fake Claude Desktop, Chrome, Exodus or Docker Desktop installer ZIP. Behaviour-first: no hash or domain dependency, so it survives loader rebuilds. The KQL form also matches the three known loader SHA256 values.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.002, T1036.005, T1204.002
- **Data sources:** sysmon, DeviceImageLoadEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 earliest=-24h
(ImageLoaded="*\\libcef.dll" OR ImageLoaded="*\\tempdir.dll")
(Image="*\\jcef_helper.exe" OR Image="*\\Chrome.exe" OR Image="*\\DockerDesktop.exe" OR Image="*\\sslconf.exe")
(ImageLoaded="C:\\Users\\*" OR ImageLoaded="C:\\ProgramData\\*")
NOT Image="*\\JetBrains\\*"
| stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as loaded_dll values(Hashes) as hashes by host, User, Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host User Image loaded_dll hashes count
```

### Microsoft KQL

```kql
let ioc_dll_sha256 = dynamic(["6b8ecc210ac8a9a22c357bc798e39d4effa3f164b70eb672568738b90b3458f7","6ccd6b67d9b7cb52599e0c9546a2e5d0836b3765e72913b7228e7959688cf3c2","37a82d0c071c7eb36be9a04b0f5a6b2fdb387bf8f08b5e2ac6df2605ebb0f556"]);
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("libcef.dll","tempdir.dll") and InitiatingProcessFileName in~ ("jcef_helper.exe","Chrome.exe","DockerDesktop.exe","sslconf.exe") and (FolderPath startswith @"C:\Users\" or FolderPath startswith @"C:\ProgramData\") and InitiatingProcessFolderPath !contains @"\JetBrains\") or SHA256 in~ (ioc_dll_sha256)
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, FolderPath, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: VMLoader and GPULoader DLL Sideloading via libcef.dll or tempdir.dll
id: 3f6a1c52-8b1e-4d57-9a3e-5e2c7d4b1a01
status: experimental
description: Detects renamed legitimate executables (jcef_helper.exe, Chrome.exe, DockerDesktop.exe, sslconf.exe) loading libcef.dll (VMLoader) or tempdir.dll (GPULoader) from C:\Users or C:\ProgramData, as seen in the TL-2026-5534 SectopRAT delivery chain.
references:
    - https://exatrack.com/publications/sectoprat-gpuloader.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.defense-evasion
    - attack.t1574.002
    - attack.t1036.005
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        ImageLoaded|endswith:
            - '\libcef.dll'
            - '\tempdir.dll'
    selection_img:
        Image|endswith:
            - '\jcef_helper.exe'
            - '\Chrome.exe'
            - '\DockerDesktop.exe'
            - '\sslconf.exe'
    selection_path:
        ImageLoaded|startswith:
            - 'C:\Users\'
            - 'C:\ProgramData\'
    filter_jetbrains:
        Image|contains: '\JetBrains\'
    condition: selection_dll and selection_img and selection_path and not filter_jetbrains
falsepositives:
    - Legitimate Electron or CEF applications installed per-user that ship a libcef.dll next to a renamed helper executable
    - Developer test builds of JCEF applications run from a user profile
level: high
```

**Known false positives:**

- Legitimate per-user Electron/CEF applications that ship libcef.dll beside a helper executable named jcef_helper.exe or Chrome.exe
- JetBrains IDE or JCEF developer builds run from a user profile (the JetBrains path is already excluded)

**Tuning notes:** Add known-good per-user CEF application paths to the NOT clause after a 7-day baseline. Enable Sysmon EventCode 7 for these filenames only (include filter on libcef.dll and tempdir.dll) to keep volume low. Pivot on the Hashes field against the VMLoader/GPULoader SHA256 IOCs in research.json.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake Installer Lure Binaries, Homoglyph Executables and sslconf.exe in AppData — Exploitation Phase (locked: unlock with TL Creds)
- FakeGuard AitM Tooling — Rogue Root CA, Local PAC Proxy 127.0.0.1:8877 and Site Guard Extension — Post-Exploitation (locked: unlock with TL Creds)
- SectopRAT, FakeGuard and VMLoader Network IOC Match with Community Sibling Infrastructure — C2 (locked: unlock with TL Creds)
- Defender Exclusion Added for C:\Users via Add-MpPreference (VMLoader and SteamLoader) — Exploitation Phase (locked: unlock with TL Creds)
- GPULoader Runtime Behaviour — .NET CLR and D3D11/DXGI Loaded by Process in Cisco AnyConnect AppData Folder — Post-Exploitation (locked: unlock with TL Creds)
- FakeGuard siteguard.exe Child Process and C2 Beacon References ([indicator], /api/device/commands) — C2 (locked: unlock with TL Creds)
- Loader Persistence — EdgeUpdate Scheduled Task, Loader Run Keys and Cisco AnyConnect Profile Drop — Post-Exploitation (locked: unlock with TL Creds)
- EtherHiding C2 Resolution — Non-Browser Process Querying BSC RPC (bsc-dataseed) — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- IP address: `45.59.122[.]85`
- Domain: `legsotier[.]us`
- File hash: `197b6c515cbb9696f3ba1b8a40857189e9de8fc9fa7787fa3e154c9fcf3ea31c`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SectopRat's GPULoader and VMLoader - ExaTrack](https://exatrack.com/publications/sectoprat-gpuloader.html)
- [SectopRat's GPULoader and VMLoader - Malpedia library entry](https://malpedia.caad.fkie.fraunhofer.de/library/04ce19fd-d742-468f-8532-4e85720f002e/)
- [GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe - Arctic Wolf](https://arcticwolf.com/resources/blog/gpugate-malware-malicious-github-desktop-implants-use-hardware-specific-decryption-abuse-google-ads-target-western-europe)
- [Ongoing malvertising campaign targets European IT workers with fake GitHub Desktop installers - Help Net Security](https://www.helpnetsecurity.com/2025/09/09/github-desktop-malvertising-it-workers/)
- [SectopRAT Returns, Hiding Inside a Legitimate Application - Dark Reading (Fortinet ArechClient2 variant)](https://www.darkreading.com/cyberattacks-data-breaches/sectoprat-returns-hiding-inside-legitimate-application)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5534