Trojanized RVTools: Python Stager Linked to UNC2465

Vega Threat Research investigated a customer intrusion in which an administrator installed a trojanized RVTools MSI obtained through a sponsored search result. RVTools is a free inventory utility for VMware vSphere, so the lure reaches users with privileged access to vCenter and ESXi environments. A second installer sample from a public sandbox submission carries the same DeviceSync dropper alongside a SmokedHam-style dropper built from the same template, and a Russian-language developer comment describes the DeviceSync launcher as modeled on the SmokedHam one. Based on this shared tooling and on overlaps in the RVTools malvertising delivery chain, the activity is assessed with moderate confidence to be associated with UNC2465 (Storm-0241), a financially motivated actor historically tied to DarkSide ransomware and since linked to LockBit, Hunters International and Qilin operations.

Initial access begins with a Google Ads result for "rvtools" that routes through Google's ad-click redirect to a Cloudflare-fronted lookalike site. The page runs a bot check, polls a second lookalike domain and filters traffic, so the download page does not appear outside the original ad flow. The download button points to an Azure Front Door endpoint that redirects to Dropbox, where the MSI is hosted. The MSI is unsigned and its ProductName and Manufacturer values do not match RVTools, a departure from earlier UNC2465 RVTools campaigns that used EV-signed NSIS installers.

During installation, the MSI deploys the genuine Dell-signed RVTools as a decoy while a batch dropper runs in the background. The dropper uses the built-in tar utility to extract a full CPython 3.12 runtime, including pycryptodome and pythonnet, into a ProgramData folder named to resemble a Windows component, and renames the windowless interpreter to UsbService64.exe. Persistence is a one-time SYSTEM scheduled task that fires five minutes after installation and a logon-triggered SYSTEM scheduled task, both running a batch launcher through cmd.exe that starts the renamed interpreter against DeviceSync.py. The dropper also writes an HKLM Run value pointing to a shortcut that this build never creates, so that mechanism does not function.

DeviceSync is a lightly obfuscated Python stager. On first run it generates an agent ID, collects the host name, user, domain, OS version, administrative rights, running processes and system information, and registers with a Cloudflare Workers C2 over HTTPS POST, using AES-CBC with an HMAC-SHA256 tag and TLS certificate validation disabled. After registration it sleeps 72 hours by default before polling every 20 minutes, and the C2 can change both intervals, rotate the C2 address or stop the agent. In the investigated intrusion, the only C2 traffic was a burst of six short connections within 45 seconds of the first run. The stager carries an encrypted .NET assembly that it decrypts and loads in memory through pythonnet only when the C2 supplies the key, so the second stage was not recovered.