The report describes a multi-stage intrusion chain initiated through phishing emails that deliver double-extension ZIP lures and transition into a WebDAV-hosted payload sequence. The operators abuse Cloudflare free-tier infrastructure and bundled Python components to deploy AsyncRAT on victim endpoints. Execution and persistence rely on native Windows tooling—Windows Script Host, PowerShell, and batch scripts—while the final stage uses code injection into explorer.exe. By routing delivery and staging through widely trusted cloud services, the activity blends into normal traffic and can evade conventional perimeter controls.
Trend Micro investigators reported telemetry consistent with a staged delivery flow: retrieval of a .pdf.zip archive from Dropbox, execution of embedded .url shortcuts, and subsequent WebDAV interaction attributed to svchost.exe and rundll32.exe. The chain then deployed Python 3.14.0 embedded files, which were used to run a custom Python script responsible for APC injection of AsyncRAT shellcode. Persistence was achieved by placing batch files in the user Startup directory. Analysts also identified and correlated multiple TryCloudflare hosts supporting the infrastructure.
Reduce exposure by training users to treat double-extension archives and unexpected ZIP attachments as suspicious and by tightening filtering for phishing-delivered cloud links. Block or strictly control access to unsanctioned cloud-tunneling services and monitor for abnormal reliance on WebDAV in environments where it is uncommon. Restrict script execution from user-writable directories, and harden controls around Startup folder usage and scheduled-task creation. Prioritize EDR/behavioral detections that can surface script-driven execution chains and code-injection techniques targeting benign processes.
If activity is detected, isolate the endpoint and stop suspicious processes associated with the chain (notably svchost.exe, rundll32.exe, and python.exe where tied to the incident). Remove persistence by deleting malicious batch artifacts from the Startup directory, eradicate downloaded Python archives and any AsyncRAT components, and perform a full forensic sweep for additional staging files and lateral movement. Update network controls and blocklists to include the identified TryCloudflare domains and any associated infrastructure observed during triage.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Attack Narrative & Commands
An adversary who has gained initial PowerShell access on a compromised Windows host wants to set up a Python execution environment and achieve persistence. They:
These steps produce exactly the command strings matched by the Sigma rule, generating PowerShell script‑block logs with the iwr … -OutFile … pattern.
Regression Test Script
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
