Signed EXE does not mean a safe DLL load.
The DFIR Report walked an infection chain that used legitimate SonicWall, IBM WinWrap, Blue Iris, and ON1 apps to drop SectopRAT (ArechClient2) in memory, with C2 config pulled from a BNB Smart Chain contract.
X (formerly Twitter)The DFIR Report (@TheDFIRReport) on XJust because an EXE is signed doesn't mean everything it loads is safe.
We came across an interesting infection chain where threat actors used legitimate, signed executables from SonicWall, IBM, Blue Iris, and ON1 to ultimately deploy SectopRAT (ArechClient2).
They took legitimate DLLs shipped wi…
