Malicious RVTools Installer Abuses Sectigo Certificate to Bypass SmartScreen Warnings

Key Takeaways

• A new threat actor is distributing a weaponized installer for RVTools, a popular utility for VMware administrators.
• The malicious installer bypasses Windows SmartScreen by using a valid Sectigo code-signing certificate, making it appear legitimate.
• The attack deploys a multi-stage Python-based Remote Access Trojan (RAT) capable of extensive system reconnaissance and persistent remote control.
• Organizations managing VMware environments are at significant risk due to the high-privilege access typically granted to RVTools users.

Attackers Leverage Valid Sectigo Certificate to Distribute Malicious RVTools Installer

Cybersecurity researchers have identified a sophisticated supply chain attack targeting VMware administrators through a weaponized installer of RVTools, a widely used utility. Attackers are distributing a malicious version of the application, digitally signed with a legitimate Sectigo certificate, enabling it to circumvent Windows SmartScreen warnings and other standard endpoint security measures.

RVTools is an essential tool for IT administrators, providing critical visibility into virtual machine environments. Its prevalence in enterprise settings and the elevated privileges often associated with its users make it an ideal target for impersonation, as compromising such an account can grant attackers deep access into an organization’s virtual infrastructure.

Deceptive Tactics Exploit Trust in Signed Software

Analysts at K7 Security Labs were the first to detail this attack. Their report, shared with Cyber Security News (CSN), revealed that the fake installer was signed with a valid code-signing certificate issued by Sectigo. This certificate was registered under “Xiamen Lunwei Huage Network Co., Ltd.,” an entity that appears to be a shell company. Crucially, the certificate was active and valid at the time of delivery, allowing the malicious installer to execute without triggering alerts from Windows SmartScreen or most endpoint protection systems.

The malicious installer was packaged as a standard MSI file, complete with an End-User License Agreement, mimicking legitimate software installations. This deliberate design was intended to exploit the trust users place in signed binaries and familiar installation procedures, providing little reason for an administrator to suspect foul play.

Multi-Stage Payload Delivery

Upon execution and granting of administrative privileges, the installer initiated a covert, multi-stage infection process. It first deployed a hidden VBScript, “Binary.MyScript.vbs,” embedded within the MSI’s binary table. This script utilized decimal-to-character encoding to obscure its true purpose from security scanners.

The VBScript then launched a concealed PowerShell process, which downloaded a 33MB archive named “winp.zip” from a Dropbox link. This archive was extracted into the AppData folder, containing a portable Python environment. This environment included legitimate tools like VS Code, Spyder, and Jupyter Lab, alongside malicious scripts. The inclusion of numerous benign tools served to camouflage the malicious components during file system audits.

Following a prompt for a system reboot, framed as a routine cleanup after installation, the malware established its persistence mechanisms in the background.

Three-Stage Python RAT Deploys After Installation

After the system restart, two Python scripts, “collector.py” and “Pmanager.py,” became active. “collector.py” initiated an extensive reconnaissance operation, gathering sensitive host information including hostname, MAC address, user privileges, installed services, running processes, and Active Directory details. This collected data was hashed into a unique eight-character ID to enable the attackers to track the compromised system, even if its IP address changed. All gathered information was saved to a file named “configA.json” in the temporary folder.

Subsequently, “Pmanager.py” encrypted the collected data using RC4 encryption combined with zlib compression. This encrypted data was then exfiltrated to one of five hardcoded command-and-control (C2) servers via HTTP POST requests. The Remote Access Trojan (RAT) beaconed to its C2 every 300 seconds, awaiting instructions. Its capabilities included executing arbitrary commands, launching PowerShell scripts, downloading additional payloads, and self-removal.

To ensure persistence across reboots, the RAT created a Windows Registry Run entry and established a scheduled task with SYSTEM-level privileges, granting it maximum control over the compromised machine. For any organization heavily reliant on VMware, a breach through this vector, especially involving an administrator account, presents a catastrophic security event.

Although the fraudulent certificate has since been revoked, this offers limited protection to environments that do not perform real-time certificate revocation checks at the point of execution. Systems relying solely on static signature validation would not have detected the malicious nature of the installer.

What You Should Do

• Verify Software Sources: Always download RVTools installers exclusively from the official website, robware.net. Avoid third-party repositories or suspicious links.
• Implement Real-Time Certificate Checks: Ensure your security solutions enforce real-time certificate revocation list (CRL) and Online Certificate Status Protocol (OCSP) checks at the time of execution for all binaries.
• Monitor for Suspicious Files: Actively scan and monitor AppData directories for unexpected files like “winp.zip” or unusual Python processes launched from non-standard paths.
• Restrict Outbound Connections: Implement network segmentation and firewall rules to restrict outbound connections from administrative workstations to only known and necessary IP addresses and domains.
• Review Indicators of Compromise (IoCs): Integrate the provided IoCs into your SIEM, EDR, and other security tools for detection and blocking.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.