---
title: Hunt: Google Ads for 'rvtools' led vSphere admins to a trojanized MSI that installs a renamed-Python stager with Cloudflare Workers C2 and a 72-hour sleep; Vega links it to UNC2465 | ctxsec
url: https://ctxsec.com/items/hunt-trojanized-rvtools-google-ads-devicesync-python-stager-unc2465
description: "Vega Threat Research investigated an October intrusion in which an admin clicked a sponsored Google result for RVTools, the VMware inventory tool, and got a trojanized MSI from a lookalike site via Azure Front Door and Dropbox. The installer runs a real Dell-signed RVTools as a decoy while a batch dropper installs a full Python runtime with the interpreter renamed UsbService64.exe and a stager, DeviceSync.py, that registers with Cloudflare Workers C2 and then sleeps 72 hours by default. Vega ties it with moderate confidence to UNC2465 (Storm-0241), a ransomware-linked actor. Because the victims are hypervisor admins, look back to late May."
status: "official (Vega Threat Research, Nov 2); UNC2465 link is Vega's moderate-confidence assessment"
published: 2026-11-02
---

> Vega Threat Research investigated an October intrusion in which an admin clicked a sponsored Google result for RVTools, the VMware inventory tool, and got a trojanized MSI from a lookalike site via Azure Front Door and Dropbox. The installer runs a real Dell-signed RVTools as a decoy while a batch dropper installs a full Python runtime with the interpreter renamed UsbService64.exe and a stager, DeviceSync.py, that registers with Cloudflare Workers C2 and then sleeps 72 hours by default. Vega ties it with moderate confidence to UNC2465 (Storm-0241), a ransomware-linked actor. Because the victims are hypervisor admins, look back to late May.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-trojanized-rvtools-google-ads-devicesync-python-stager-unc2465.md)

official (Vega Threat Research, Nov 2); UNC2465 link is Vega's moderate-confidence assessment

2026-11-02

### Hunt: Google Ads for 'rvtools' led vSphere admins to a trojanized MSI that installs a renamed-Python stager with Cloudflare Workers C2 and a 72-hour sleep; Vega links it to UNC2465

- **Delivery:** sponsored result via googleadservices.com redirect to `rvtok[.]app` (polls `rvtooks[.]com`), then `web-app-server-gqdmgecbb2e6czg3.z03.azurefd[.]net/id-RVTools4.7.1?q=RVTools`, then Dropbox. Infrastructure first seen May 25, 2026.
- **Installer tells:** unsigned MSI whose ProductName/Manufacturer don't match (e.g. TeamsUpdater_A28 / UpdateSoft_U3E3AX), installing to `Program Files (x86)\TeamsUpdater\` or `\UpdateWindowsSoft\`.
- **On host:** `deploy.bat` extracts python.zip with `tar.exe` into `C:\ProgramData\Microsoft\DiskCleanup\` or `\DeviceSync\`; pythonw renamed `UsbService64.exe`; SYSTEM scheduled tasks `LanguagePack` (one-time, +5 min) and `SecurityHealth` (logon), or `DeviceSyncInit/DeviceSyncAgent/DeviceSyncCleanup`; Run values `OfficeHelper` or `MyAppUpdate`; in one sample, MSDTC persistence via `HKLM\SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath`.
- **C2:** HTTPS POST, AES-CBC plus HMAC, TLS verification off, to `red-fire-92b4.redis-3a9.workers[.]dev` and `rough-base-bddc.web-static-4jf.workers[.]dev`; a burst of about six connections in the first 45 s, then quiet for 72 h, then 20-minute polls. Carries an encrypted .NET assembly loaded in memory via pythonnet once C2 sends the key (contents unknown).

**Hunt ideas:** search historical telemetry back to late May for the domains and hashes in Vega's post (e.g. MSI SHA-256 `4d5b1ead...ce34ee5`, `c3986133...ff605677`); renamed python/pythonw anywhere under ProgramData\Microsoft; schtasks creating SYSTEM tasks that run .bat files from user-writable folders; Windows Installer events 1033/11707 for MSIs named like admin tools. If an admin workstation is hit, review vCenter/ESXi access and rotate credentials and vault secrets reachable from it.

Sources: [Vega: Trojanized RVTools: Python Stager Linked to UNC2465 (Nov 2)](https://vega.io/blog/trojanized-rvtools-python-stager-linked-to-unc2465)