Socprime

AsyncRAT Deployment via Phishing and Cloudflare Exploitation

First seen 15 Jan 2026, 03:18 UTC • Feeds.Trendmicro

•82% similarity •31.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Threat actors have leveraged phishing emails to initiate a multi-stage intrusion chain that deploys the AsyncRAT remote access trojan. This operation utilizes Cloudflare's free-tier infrastructure and legitimate Python environments, employing Windows-native tools for execution and persistence. Victims are targeted through double-extension ZIP files leading to a WebDAV-hosted payload sequence.

ThreatCluster AI How this analysis works

Attack Flow

23 entities, 42 inferred relationships (STIX 2.1).

Technique (8)

Malware
Phishing
T1053 - Scheduled Task
T1055 - Process Injection
T1059.001 - PowerShell
T1059.003 - Windows Command Shell
T1059.005 - Windows Script Host
T1059.007 - Windows Script Host

Campaign (1)

AsyncRAT Campaign

Organization (1)

Cloudflare

Malware (1)

AsyncRAT

Affected Platform (4)

Microsoft Edge
TryCloudflare
WebDAV
Windows

Tool (8)

Dropbox
PowerShell
Python
Python.exe
Rundll32
Rundll32.exe
Svchost.exe
Windows Script Host

Relationships

AsyncRAT Campaign uses AsyncRAT
AsyncRAT targets Cloudflare
Malware targets Microsoft Edge
Malware targets TryCloudflare
Malware targets WebDAV
Malware targets Windows
Phishing targets Microsoft Edge
Phishing targets TryCloudflare
Phishing targets WebDAV
Phishing targets Windows
T1053 - Scheduled Task targets Microsoft Edge
T1053 - Scheduled Task targets TryCloudflare
T1053 - Scheduled Task targets WebDAV
T1053 - Scheduled Task targets Windows
T1055 - Process Injection targets Microsoft Edge
T1055 - Process Injection targets TryCloudflare
T1055 - Process Injection targets WebDAV
T1055 - Process Injection targets Windows
T1059.001 - PowerShell targets Microsoft Edge
T1059.001 - PowerShell targets TryCloudflare
T1059.001 - PowerShell targets WebDAV
T1059.001 - PowerShell targets Windows
T1059.003 - Windows Command Shell targets Microsoft Edge
T1059.003 - Windows Command Shell targets TryCloudflare
T1059.003 - Windows Command Shell targets WebDAV
T1059.003 - Windows Command Shell targets Windows
T1059.005 - Windows Script Host targets Microsoft Edge
T1059.005 - Windows Script Host targets TryCloudflare
T1059.005 - Windows Script Host targets WebDAV
T1059.005 - Windows Script Host targets Windows
T1059.007 - Windows Script Host targets Microsoft Edge
T1059.007 - Windows Script Host targets TryCloudflare
T1059.007 - Windows Script Host targets WebDAV
T1059.007 - Windows Script Host targets Windows
AsyncRAT Campaign related to Dropbox
AsyncRAT Campaign related to PowerShell
AsyncRAT Campaign related to Python
AsyncRAT Campaign related to Python.exe
AsyncRAT Campaign related to Rundll32
AsyncRAT Campaign related to Rundll32.exe
AsyncRAT Campaign related to Svchost.exe
AsyncRAT Campaign related to Windows Script Host

Community

Browse all →

Tracked Entities in This Story

AsyncRAT AsyncRAT Campaign Cloudflare Microsoft Edge TryCloudflare WebDAV Windows

AsyncRAT Deployment via Phishing and Cloudflare Exploitation

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story