A trusted tool for VMware administrators has been weaponized. Attackers built a fake version of RVTools, a widely used utility for managing virtual infrastructure, and disguised it with a real digital certificate to slip past Windows security warnings without raising a flag.<\/a><\/p>\n RVTools is a staple in enterprise environments. IT administrators rely on it daily to get detailed visibility into virtual machines and infrastructure. Because it is typically run by people with high-level domain access, it made for a perfect impersonation target. <\/p>\n Whoever built this fake installer knew that, crafting a campaign to exploit the trust that enterprise teams place in signed software.<\/a><\/p>\n Analysts at\u00a0K7 Security Labs\u00a0identified and reported the attack in detail. K7 Security Labs said in a report<\/a> shared with\u00a0Cyber Security News (CSN)\u00a0that the fake installer carried a valid code-signing certificate issued by Sectigo, registered under what appears to be a shell entity called Xiamen Lunwei Huage Network Co., Ltd. <\/p>\n At the time of delivery, the certificate was fully valid, meaning Windows SmartScreen and most endpoint controls raised no warnings.<\/a><\/p>\n What followed was a fully structured, three-stage attack. The malware dropped a hidden script inside the installer, ran a quiet reconnaissance sweep of the victim\u2019s system, and established a persistent remote access channel that phoned home every five minutes. <\/p>\n For any organization running VMware at scale, a compromised administrator account through this vector is essentially game over.<\/a><\/p>\n The certificate has since been revoked. However, this only offers limited protection to environments not enforcing real-time certificate checks at execution. Any environment relying solely on static signature validation would have seen nothing suspicious.<\/a><\/p>\n The installer used a digitally signed MSI file paired with a standard End-User License Agreement to build a convincing layer of false legitimacy. <\/p>\n Administrators who regularly encounter signed binaries with legal agreements would have little reason to question it. The attacker understood this pattern and exploited it deliberately.<\/p>\n Once a user ran the file and granted administrative privileges, the installer quietly triggered a hidden VBScript stored inside the MSI\u2019s binary table. <\/p>\n This script used decimal-to-character encoding to hide its real instructions, ensuring security scanners saw nothing alarming. It then spawned a hidden PowerShell process that downloaded a roughly 33MB archive called winp.zip from a Dropbox link and extracted it into the AppData folder<\/a>.<\/a><\/p>\n The archive contained a portable Python environment including VS Code, Spyder, Jupyter Lab, and PowerShell, burying malicious scripts among dozens of trusted tools that would appear normal in any file system audit. <\/p>\n After a reboot prompt framed as cleaning up installation files, persistence mechanisms activated quietly in the background.<\/a><\/p>\n Once the system restarted, two Python scripts got to work. The first, collector.py, performed a deep sweep of the host, gathering the hostname, MAC address, user privileges, installed services, running processes, and Active Directory details. <\/p>\n It hashed those identifiers into a unique eight-character ID so the attacker could track the victim even across IP address changes. All collected data was saved into a file called configA.json in the temp folder.<\/a><\/p>\n The second script, Pmanager.py, encrypted that data using RC4 combined with zlib compression and sent it to one of five hardcoded command-and-control server addresses over HTTP POST requests. <\/p>\n The RAT beaconed every 300 seconds and could receive instructions to run executables, launch PowerShell commands, download additional payloads, or remove itself from the machine entirely. <\/p>\n To survive reboots, it wrote a Windows Registry Run entry and created a scheduled task running with SYSTEM-level privileges.<\/a><\/p>\n Organizations using VMware should verify that any RVTools installer was downloaded directly from the official website at robware.net. <\/p>\n Security teams are advised to monitor for unexpected winp.zip files<\/a> in AppData directories, watch for Python processes launched from unusual paths, and enforce real-time certificate revocation checks at execution. <\/p>\n Blocking outbound connections to unknown IP addresses<\/a> from administrative workstations adds meaningful protection against attacks like this one.<\/a><\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/p>\n![\"Execution](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhuN-fBWPyofdIFaKOCU9G-PO0Upg0Md8ikpVuYafJKeheYuS8lbDla8jLHIYR60E4zWxXM9InCcRiuTYzrZK5ERH8tXfBTlCcafn0UMA-Va8sq893LzCe-HgvQc5kGw5GyBsIaIrlbdQfwoxwGXRVZGp5tLhRdOY-KYtJ6jiUq85Wdd1FSi87o5J0_kL8\/s16000\/Execution%2520Flow%2520of%2520RAT%2520%28Source%2520-%2520K7%2520Security%2520Labs%29.webp?ssl=1\")
Sectigo Certificate Used to Slip Past SmartScreen<\/strong><\/h2>\n
![\"Decoded](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjNFE3ASmPi3-24xPn0jnrq-K2CXX032-A2rYwIl_Dp11SPaycrbYuJeTTC9767h-2pifI6A3V7Q3jh3QbPpCAxOwqtTw34inalHWem4rGwupf2MkYybiJvIPTNHD_5B6FzZdPsGLpCzJsqrlgcjXtEa-3DYUCVEajMDsCLyRt9mgAioXjHhKNg6p65Qxo\/s16000\/Decoded%2520Powershell%2520command%2520from%2520CyberChef%2520%28Source%2520-%2520K7%2520Security%2520Labs%29.webp?ssl=1\")
Three-Stage Python RAT Deploys After Installation<\/strong><\/h2>\n
![\"System](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiT2d2Z6CNUA25nfjxF54JIBP015B9r7wYFcUZnc-pw8PBUYxX0p3G0khALZ4MxotR3iQzSdFcANJZXV4eSJIK1ti838eFuIfFMDd6vWkktm63ld4ow0MXSyV3KCxuim3bHf0JUI93XDSQ1HF2-OkvG0KFOOZesPTmbtj6mNSHld4Jn-LpVyfplCCJ4HsY\/s16000\/System%2520Environment%2520%26%2520Persistence%2520Manager%2520%28Source%2520-%2520K7%2520Security%2520Labs%29.webp?ssl=1\")