AsyncRAT Deployment via Phishing and Cloudflare Exploitation

Socprime

AsyncRAT Deployment via Phishing and Cloudflare Exploitation

First seen 15 Jan 2026, 03:18 UTC • •31.3

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Threat actors have leveraged phishing emails to initiate a multi-stage intrusion chain that deploys the AsyncRAT remote access trojan. This operation utilizes Cloudflare's free-tier infrastructure and legitimate Python environments, employing Windows-native tools for execution and persistence. Victims are targeted through double-extension ZIP files leading to a WebDAV-hosted payload sequence.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 182d ago How this analysis works

More articles in this cluster (3)

Threat Graph

23 entities, 42 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Malware
Phishing
T1053 - Scheduled Task
T1055 - Process Injection
T1059.001 - PowerShell
T1059.003 - Windows Command Shell
T1059.005 - Windows Script Host
T1059.007 - Windows Script Host

Campaign (1)

AsyncRAT Campaign

Organization (1)

Cloudflare

Malware (1)

AsyncRAT

Affected Platform (4)

Microsoft Edge
TryCloudflare
WebDAV
Windows

Tool (8)

Dropbox
PowerShell
Python
Python.exe
Rundll32
Rundll32.exe
Svchost.exe
Windows Script Host

Relationships

AsyncRAT Campaign uses AsyncRAT
AsyncRAT targets Cloudflare
Malware targets Microsoft Edge
Malware targets TryCloudflare
Malware targets WebDAV
Malware targets Windows
Phishing targets Microsoft Edge
Phishing targets TryCloudflare
Phishing targets WebDAV
Phishing targets Windows
T1053 - Scheduled Task targets Microsoft Edge
T1053 - Scheduled Task targets TryCloudflare
T1053 - Scheduled Task targets WebDAV
T1053 - Scheduled Task targets Windows
T1055 - Process Injection targets Microsoft Edge
T1055 - Process Injection targets TryCloudflare
T1055 - Process Injection targets WebDAV
T1055 - Process Injection targets Windows
T1059.001 - PowerShell targets Microsoft Edge
T1059.001 - PowerShell targets TryCloudflare
T1059.001 - PowerShell targets WebDAV
T1059.001 - PowerShell targets Windows
T1059.003 - Windows Command Shell targets Microsoft Edge
T1059.003 - Windows Command Shell targets TryCloudflare
T1059.003 - Windows Command Shell targets WebDAV
T1059.003 - Windows Command Shell targets Windows
T1059.005 - Windows Script Host targets Microsoft Edge
T1059.005 - Windows Script Host targets TryCloudflare
T1059.005 - Windows Script Host targets WebDAV
T1059.005 - Windows Script Host targets Windows
T1059.007 - Windows Script Host targets Microsoft Edge
T1059.007 - Windows Script Host targets TryCloudflare
T1059.007 - Windows Script Host targets WebDAV
T1059.007 - Windows Script Host targets Windows
AsyncRAT Campaign related to Dropbox
AsyncRAT Campaign related to PowerShell
AsyncRAT Campaign related to Python
AsyncRAT Campaign related to Python.exe
AsyncRAT Campaign related to Rundll32
AsyncRAT Campaign related to Rundll32.exe
AsyncRAT Campaign related to Svchost.exe
AsyncRAT Campaign related to Windows Script Host

Following this threat?

Track AsyncRAT and Cloudflare in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Surge in Exploited CVEs and Malware Activity in H1 2026 In the first half of 2026, Insikt Group reported 215 actively exploited CVEs, marking a 34% increase from the previous year. Notably, AsyncRAT emerged as the leading malware, with nearly 60,000 unique hashes. The report highlighted a significant rise in NFC-based Android attacks, which surged by 188%. Threat actors…

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…