Loading story…
Censys published a threat overview tracing the AsyncRAT malware family from its 2019 open-source release into a multi-generation lineage of roughly 40 remote access trojan variants, with DCRAT identified as the most prolific descendant and additional forks including VenomRAT, Gh0stRAT, BitRAT, EchoRAT, LMTeamRAT, JasonRAT, Dumpling RAT, CyberSpike, DarkRAT, and Alfa Red Fox. The report says inherited TLS certificate metadata provides the most reliable way to connect these families, especially self-signed certificates on non-standard ports that use the pattern O=<Name> By <author>, L=SH, C=CN.
As of 16 June 2026, Censys had confirmed live command-and-control infrastructure for 13 variants, including about 49 AsyncRAT hosts, 36 DCRAT hosts, 21 Gh0stRAT hosts, and 18 VenomRAT hosts. The researchers said builder handles such as qwqdanchun and alexeikun appearing in certificate Subject and Issuer fields help link forks to shared development lineage, while name-based hunting is less dependable because labels such as PhoenixRAT, PegasusRAT, and MagnumRAT can overlap with legitimate or unrelated software.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Censys ARC published a threat intelligence report mapping roughly 40 AsyncRAT-related variants across multiple generations of forks. The report identified inherited DCRAT TLS certificate metadata, especially the pattern "O=<Name> By <author>, L=SH, C=CN" on non-standard ports, as the strongest family-wide detection signal.
Censys searches confirmed live command-and-control infrastructure for 13 AsyncRAT-family variants, with the largest footprints observed for AsyncRAT, DCRAT, Gh0stRAT, and VenomRAT. The report also noted single-host or zero-host footprints for several lower-volume forks.
Censys reported that one rarer, fully rebranded Gh0stRAT certificate was first seen with subject CN=Gh0st RAT and issuer CN=Gh0st Server. The observation helped distinguish this AsyncRAT-lineage Gh0stRAT from the unrelated original Gh0st RAT family.
AsyncRAT, an open-source Windows remote access trojan, was first published on GitHub by the developer NYAN-x-CAT. Censys identifies this release as the starting point for a malware family that later expanded into dozens of forks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecensys.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **AsyncRAT** and **QuasarRAT** continue to appear in real-world intrusions as commodity remote access trojans, with many operators relying on default or poorly customized configurations that leave recognizable forensic artifacts. Analysis highlighted recurring indicators including common C2 ports, predictable mutex naming, persistence mechanisms, and dropped plugin DLLs for AsyncRAT, while QuasarRAT samples were also tied to a default C2 port, a consistent mutex format, persistence behavior, and a hard-coded user-agent string. Defenders were advised that these operational shortcuts create practical hunting opportunities across enterprise environments, especially because both malware families are open-source or long-established tools that remain effective when organizations fail to detect known threats. Supporting technical reporting on AsyncRAT and broader adversary infrastructure trends reinforced that investigators can use endpoint and threat intelligence tooling such as **Velociraptor**, **ThreatFox**, and **THOR Scanner** to identify infected hosts and trace related infrastructure.
Aug 1, 2026
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026
Breakglass Intelligence reported an active campaign using a custom AsyncRAT fork dubbed **PhishingRAT**, attributed to a Vietnamese-speaking cybercriminal operator. Investigators linked at least 12 samples built around lure themes including **PhishingRAT**, **RobloxHack**, and **Spotify**, and identified live, Cloudflare-fronted command-and-control infrastructure at `alam[.]it[.]com`, `datadreamers[.]in[.]net`, `sc88[.]now`, and `indotech[.]it[.]com`. The malware retained standard AsyncRAT capabilities such as keylogging, remote control, persistence via registry Run keys and scheduled tasks, and data exfiltration, while also adding HTTP flood functionality, aggressive persistence, and behavior intended to disable Microsoft Defender. The campaign’s defining feature was a **sandbox pollution engine** that generated large volumes of fake malicious activity instead of simply terminating in analysis environments. Researchers observed simulated phishing POSTs, SQL injection, ransomware actions, credential theft, fake credit-card submissions, crypto-mining, port scanning, and other decoy behaviors designed to overwhelm PCAPs and automated detections while concealing genuine RAT traffic. Attribution was supported by multiple operational security failures, including a leaked Vietnamese-language debug PDB path, Debug builds, plaintext configuration data, weak hardcoded AES keys, reused mutexes, and the campaign label **`TestVT`**, suggesting repeated testing against VirusTotal.
Jun 29, 2026