AsyncRAT Campaign Uses Python Payloads and TryCloudflare Tunnels for Stealth Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-38213 | Mark of the Web Security Feature Bypass in Microsoft Windows (CVE-2024-38213) CVE-2024-38213 is a security feature bypass in the Windows Mark of the Web (MotW) mechanism that underpins SmartScreen warnings, allowing a maliciously crafted file to bypass the usual 'file downloaded from the internet' prompt. It is triggered when a user opens attacker-supplied content that defeats or strips the MotW flag, meaning the exploit requires user interaction (CVSS UI:R) and a network-accessible delivery vector such as email or a web download. On its own the flaw grants no confidentiality or availability impact but high integrity impact (CVSS 3.1 score 6.5), and in practice it is used to evade SmartScreen protections, typically chained with other bugs to achieve fuller compromise. It affects an extremely broad population: Windows 10 (1507 through 22H2), Windows 11 (21H2 through 23H2), and Windows Server 2012 through 2022. The flaw was one of six zero-days under active attack in Microsoft's August 2024 Patch Tuesday release and was added to CISA's Known Exploited Vulnerabilities catalog on 2024-08-13; EPSS puts its 30-day exploitation probability at 13.6% (96th percentile). Do: Apply the August 2024 Microsoft security updates (Patch Tuesday, released 2024-08-13) for every affected Windows 10, Windows 11, and Windows Server version, per CISA's KEV required action; treat this as a priority patch given confirmed in-the-wild exploitation. Because the bypass requires a user to open attacker-supplied content, reinforce caution around emailed and downloaded files until patching is complete, and confirm from vendor guidance whether any interim mitigations apply in environments that cannot patch immediately. | 6.5 | 14% | KEV |
| masshundreds of millions to billions of Windows desktop and server installations |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | trycloudflare.com | ports by creating a dedicated channel (i.e., a subdomain on trycloudflare[.]com) that proxies traffic to the server. The LNK file, for it |
Full article748 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 05, 2025Malware / Network Security
A malware campaign has been observed delivering a remote access trojan (RAT) named AsyncRAT by making use of Python payloads and TryCloudflare tunnels.
"AsyncRAT is a remote access trojan (RAT) that exploits the async/await pattern for efficient, asynchronous communication," Forcepoint X-Labs researcher Jyotika Singh said in an analysis.
"It allows attackers to control infected systems stealthily, exfiltrate data and execute commands while remaining hidden – making it a significant cyberthreat."
The starting point of the multi-stage attack chain is a phishing email that contains a Dropbox URL that, upon clicking, downloads a ZIP archive.
Present within the file is an internet shortcut (URL) file, which serves as a conduit for a Windows shortcut (LNK) file responsible for taking the infection further, while a seemingly benign decoy PDF document is displayed to the message recipient.
Specifically, the LNK file is retrieved by means of a TryCloudflare URL embedded within the URL file. TryCloudflare is a legitimate service offered by Cloudflare for exposing web servers to the internet without opening any ports by creating a dedicated channel (i.e., a subdomain on trycloudflare[.]com) that proxies traffic to the server.
The LNK file, for its part, triggers PowerShell to execute a JavaScript code hosted on the same location that, in turn, leads to a batch script (BAT) capable of downloading another ZIP archive. The newly downloaded ZIP file contains a Python payload designed to launch and execute several malware families, such as AsyncRAT, Venom RAT, and XWorm.
It's worth noting that a slight variation of the same infection sequence was discovered last year propagating AsyncRAT, GuLoader, PureLogs Stealer, Remcos RAT, Venom RAT, and XWorm. A similar attack leveraging CVE-2024-38213, a now-patched Windows Mark-of-the-Web (MotW) bypass vulnerability, was also documented by Canadian cybersecurity company Field Effect in November 2024.
"This AsyncRAT campaign has again shown how hackers can use legitimate infrastructures like Dropbox URLs and TryCloudflare to their advantage," Singh noted. "Payloads are downloaded through Dropbox URLs and temporary TryCloudflare tunnel infrastructure, thereby tricking recipients into believing their legitimacy."
The development comes amid a surge in phishing campaigns using phishing-as-a-service (PhaaS) toolkits to conduct account takeover attacks by directing users to bogus landing pages mimicking the login pages of trusted platforms like Microsoft, Google, Apple, and GitHub.
Social engineering attacks conducted via emails have also been observed leveraging compromised vendor accounts to harvest users' Microsoft 365 login credentials, an indication that threat actors are taking advantage of the interconnected supply chain and the inherent trust to bypass email authentication mechanisms.
Some of other recently documented phishing campaigns in recent weeks are below -
- Attacks targeting organizations across Latin America that make use of official legal documents and receipts to distribute and execute SapphireRAT
- Attacks exploiting legitimate domains, including those belonging to government websites (".gov"), to host Microsoft 365 credential harvesting pages
- Attacks impersonating tax agencies and related financial organizations to target users in Australia, Switzerland, the U.K., and the U.S. to capture user credentials, make fraudulent payments, and distribute malware like AsyncRAT, MetaStealer, Venom RAT, XWorm
- Attacks that leverage spoofed Microsoft Active Directory Federation Services (ADFS) login pages to gather credentials and multi-factor authentication (MFA) codes for follow-on financially motivated email attacks
- Attacks that employ Cloudflare Workers (workers.dev) to host generic credential harvesting pages mimicking various online services
- Attacks targeting German organizations with the Sliver implant under the guise of employment contracts
- Attacks that utilize zero-width joiner and soft hyphen (aka SHY) characters to bypass some URL security checks in phishing emails
- Attacks that distribute booby-trapped URLs that deliver scareware, potentially unwanted programs (PUPs) and other scam pages as part of a campaign named ApateWeb
Recent research by CloudSEK has also demonstrated that it's possible to exploit Zendesk's infrastructure to facilitate phishing attacks and investment scams.
"Zendesk allows a user to sign up for a free trial of their SaaS platform, allowing registration of a subdomain, that could be misused to impersonate a target," the company said, adding attackers can then use these subdomains to deliver phishing emails by adding the targets' email addresses as "users" to the Zendesk portal.
"Zendesk does not conduct email checks to invite users. Which means that any random account can be added as a member. Phishing pages can be sent, in the guise of tickets assigned to the email address."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/02/asyncrat-campaign-uses-python-payloads.html