Loading story…
Security researchers reported that AsyncRAT and QuasarRAT continue to appear in real-world intrusions as commodity remote access trojans, with many operators relying on default or poorly customized configurations that leave recognizable forensic artifacts. Analysis highlighted recurring indicators including common C2 ports, predictable mutex naming, persistence mechanisms, and dropped plugin DLLs for AsyncRAT, while QuasarRAT samples were also tied to a default C2 port, a consistent mutex format, persistence behavior, and a hard-coded user-agent string.
Defenders were advised that these operational shortcuts create practical hunting opportunities across enterprise environments, especially because both malware families are open-source or long-established tools that remain effective when organizations fail to detect known threats. Supporting technical reporting on AsyncRAT and broader adversary infrastructure trends reinforced that investigators can use endpoint and threat intelligence tooling such as Velociraptor, ThreatFox, and THOR Scanner to identify infected hosts and trace related infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
COLCERT's referenced technical analysis of AsyncRAT was last updated on 23 February 2024. The supplied content does not include additional technical or campaign details beyond that update marker.
The dfir.ch article says analysis of 1,000 AsyncRAT samples from ThreatFox found that the top three C2 ports in January 2024 were 6606, 7707, and 8808. This revealed continued widespread use of default or common builder settings in the wild.
The dfir.ch article states that Proofpoint reported QuasarRAT activity targeting NATO facilities in March 2023. This is the only explicitly dated operational use event described in the references.
Recorded Future's Adversary Infrastructure Report 2023 listed AsyncRAT, Quasar RAT, PlugX, ShadowPad, and DarkComet among the top malware families detected that year. The dfir.ch article cites this report as context for the prevalence of these commodity RATs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026
Researchers identified two active remote access trojan operations built on commodity malware families, with one involving a customized QuasarRAT variant dubbed **DollRAT** or **"Lilly's RAT V8"** and the other using **njRAT v0.7d (Bladabindi)**. DollRAT was observed using a modified QuasarRAT `v1.4.1` codebase with **ConfuserEx** obfuscation, runtime string decryption, and command-and-control traffic routed through an **ngrok** TCP tunnel at `0.tcp.eu.ngrok.io:18107`, backed by AWS infrastructure in Frankfurt. The malware supports credential theft from browsers and FTP clients, keylogging with HTML-formatted logs, system reconnaissance, remote shell access, file management, remote desktop, registry changes, reverse proxying, and persistence through Run keys and scheduled tasks. Embedded branding including **"Lilly's RAT V8"** and **"C.U.M Software Inc."** suggests an actively maintained custom build rather than an unmodified public RAT. A separate analysis tracked an **njRAT** sample named `Client.exe` to a broader campaign using the hardcoded No-IP hostname `njspider.myddns.me` on TCP port `4444`, resolving to Belgian residential IP `62.235.6.231`. That operation has reportedly been active since at least late 2025, with multiple related binaries and rapid rebuilds sharing the same infrastructure. The njRAT sample retained standard capabilities including persistence via `HKCU` Run keys, keylogging, screenshots, webcam capture, remote shell, file transfer, plugin execution, USB spreading, and plaintext TCP beaconing. Across both cases, operators relied on legitimate services such as **ngrok**, **No-IP**, `ipwho.is`, and `api.ipify.org` to mask or support C2 activity, while the tooling and infrastructure pointed to low-sophistication but active commodity malware operations.
Jun 29, 2026
Censys published a threat overview tracing the **AsyncRAT** malware family from its 2019 open-source release into a multi-generation lineage of roughly **40 remote access trojan variants**, with **DCRAT** identified as the most prolific descendant and additional forks including **VenomRAT, Gh0stRAT, BitRAT, EchoRAT, LMTeamRAT, JasonRAT, Dumpling RAT, CyberSpike, DarkRAT,** and **Alfa Red Fox**. The report says inherited **TLS certificate metadata** provides the most reliable way to connect these families, especially self-signed certificates on non-standard ports that use the pattern `O=<Name> By <author>, L=SH, C=CN`. As of **16 June 2026**, Censys had confirmed live command-and-control infrastructure for **13 variants**, including about **49 AsyncRAT hosts, 36 DCRAT hosts, 21 Gh0stRAT hosts,** and **18 VenomRAT hosts**. The researchers said builder handles such as `qwqdanchun` and `alexeikun` appearing in certificate Subject and Issuer fields help link forks to shared development lineage, while name-based hunting is less dependable because labels such as `PhoenixRAT`, `PegasusRAT`, and `MagnumRAT` can overlap with legitimate or unrelated software.
Aug 15, 2026