Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Hackers Use Fake Claude Desktop and Bing Ads to Deliver SectopRAT to 29 Organizations
Excerpt
Affected endpoints showed unusual Defender exclusions, new persistence mechanisms, and outbound connections aligned with remote access and credential theft activity, leading analysts to treat incidents as full RA T-level compromises rather than benign adware. Huntress tracks this malvertising-driven operation as “FakeAgent,” highlighting the abuse of Claude’s own artifact hosting and the use of a fake Claude Desktop app as the lure. The infection chain starts with users…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | c1907d7be91f95903ad66d775c397302e7dd9228 | Medium | Score 53/100 | First seen |
| MD5 | 3eb6f92aedf74f109c7b4b0897ec39a8 | High | Score 81/100 | First seen |
| MD5 | 959c0694966742718e0d5387a3b1c105 | Medium | Score 53/100 | First seen |
| IP | 2.24.131.246 | High | Score 73/100 | First seen |
| MD5 | d838120167ad44e18fe0aa6bc00ee586 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…