AsyncRATMalware
AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer.From MISP Galaxy
Last reported 2 days ago, by Group-IB15 reports
ATT&CK techniques
6 of 84 · each with the sentence it comes from- T1053.005Scheduled Task
“T1053.005”
- T1036Masquerading
“Masquerading: Masquerade Task or Service”
- T1027Obfuscated Files or Information
“T1027”
- T1684Social Engineering
“Access to timely intelligence on emerging malware families, attacker infrastructure, delivery methods, and social engineering trends can help you identify risks sooner and respond more proactively.”
- T1055Process Injection
“T1055”
- T1055.012Process Hollowing
“T1055.012”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
15 reports, newest first · the exact sentence from each-
Inside SiriusQT: A Seriously Skilled RAT“SiriusQT has been observed in relation to other malware families, such as Remcos, XWorm, AsyncRAT and QuasarRAT/NJRAT, since SiriusQT operators may rely on shared or reused infrastructure.”
-
H1 2026 Malware Vulnerability Trends“RATs led Insikt Group malware reporting, and Recorded Future Malware Intelligence submissions identified AsyncRAT as the top submitted malware family by total unique hashes and command-and-control (C2) configurations.”
-
Cruciferra Crypter Uses Process Ghosting to Evade Detection“…marketed as Cruciferra, was first offered for sale on the Exploit forum in autumn 2025 and now underpins dozens of campaigns delivering AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger.”
-
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement“It reflectively loads an assembly implementing an AsyncRAT client, which is configured to use 41.216.188.140 as its C2 server.”
-
Threat Actors Weaponize AI Hype to Deliver AsyncRAT“Threat Actors Weaponize AI Hype to Deliver AsyncRAT”
-
Detecting Multi-Stage Infection Chains Madness“Sekoia TDR walks through a Cloudflare-tunnel infection chain delivering AsyncRAT and the Sigma rules that catch each stage.”
-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“ShadowSyndicate continues to be associated with toolkits including Cobalt Strike, MetaSploit, Havoc, Mythic, Sliver, AsyncRAT, MeshAgent, and Brute Ratel.”
-
Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response“Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response”
-
BlindEagle Targets Colombian Government Agency with Caminho and DCRAT“It is one of the prevalent variants of AsyncRAT, but distinguishes itself with new capabilities, such as patching Microsoft’s Antimalware Scan Interface (AMSI) to evade detection.In this campaign, the DCRAT configuration is encrypted using AES-256 encryption, with a symmetric key…”
-
141 Key Cybersecurity Statistics for 2026 and Beyond“Remote access trojans (RATs) like AsyncRAT and Jupyter were used in over 75% of observed remote access attacks.”
-
2025 Cybersecurity Threat Report“Remote access trojans (RATs) are more popular: Over 75% of remote access incidents utilized RATs such as AsyncRAT and Jupyter.”
-
Fake Browser Updates Lead to BOINC Volunteer Computing Software“RATs (such as AsyncRAT or NetSupport RAT) that provide Command and Control”
-
Advanced CyberChef Tips: AsyncRAT Loader“Advanced CyberChef Tips: AsyncRAT Loader”
-
The Mechanics of Defense Evasion“This was not obfuscated and the aspnet_compiler.exe line is a known technique of AsyncRAT to compile the malicious executable once it had reached the target machine (T1027.004).”
-
Kremlin RATs from Nigeria“…telligence team examined the domains and identified three phishing campaigns that were used to deliver various RATs, such as NetWire or AsyncRAT.”
Indicators in its reports
named in the reports above- 172.111.233[.]36in 1 report
- 172.111.233[.]96in 1 report
- 172.111.233[.]12in 1 report
- 172.111.233[.]105in 1 report
- 172.111.233[.]26in 1 report
- 172.94.9[.]49in 1 report
- 172.94.9[.]43in 1 report
- 172.94.9[.]19in 1 report
- 45.74.6[.]17in 1 report
- 45.125.32[.]218in 1 report
- 142.171.183[.]8in 1 report
- 193.42.25[.]65in 1 report
- 89.31.121[.]220in 1 report
- cms.balochistanpolice.gov[.]pkin 1 report
- 41.216.188[.]140in 1 report
- 000fad96a85dd693…ed47b7f1f066in 1 report
- 08570471f39bb672…99ed48c22686in 1 report
- 23f4766c011d193f…60e2a41ead79in 1 report
- 23f6781919a50b11…e63b71ecc885in 1 report
- 2bab40c55637398f…ea564d595c7fin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.