Daily Summary
AsyncRAT activity surged to 28 new samples on 2026-08-09, a 32% increase over the 7-day average of 21. The rise is driven primarily by a shift toward JavaScript-based loaders, which now account for over half of today’s detections, and a corresponding expansion of the C2 infrastructure footprint.
New Samples Detected
The file type breakdown shows a meaningful departure from recent norms. JavaScript (.js) files dominate with 15 samples, more than double the typical share from the past week. Executables (.exe) account for 7 samples, while the remaining distribution includes 2 .bin files, 2 .vbs scripts, and single instances of a .2826 file and a .bat script. The .2826 extension is unusual and may indicate an attempt to bypass extension-based filtering in email gateways or web proxies. The low count of .vbs suggests attackers are consolidating around JS as their primary dropper mechanism, likely because it blends more easily with legitimate web traffic and can be delivered via a wider range of hosting platforms.
C2 Infrastructure
The 100 new C2 servers observed today represent a substantial expansion, roughly a 70% increase over the typical daily intake seen this week. This rapid onboarding of infrastructure is consistent with a campaign that anticipates sinkholing or takedowns and rotates endpoints aggressively. The concentration of new servers suggests a single operator or a coordinated cluster spinning up infrastructure in bulk rather than organic growth. Defenders should treat the 100 new endpoints as a single campaign wave and block the entire IP range or hosting provider if patterns align, rather than chasing individual domains.
7-Day Trend
Today’s 32% deviation from the 7-day average crosses the reporting threshold and confirms an upward trajectory that has been building over the past three days. Prior to this surge, daily counts hovered between 18 and 23 samples. The jump to 28 is not an outlier but part of a sustained climb, indicating that the increase reflects operational scaling rather than a one-off batch drop.
IOC Highlights
With 128 new IOCs added today, several warrant immediate attention. The 100 C2 servers are the bulk of this count. Beyond those, the file hashes associated with the .js samples show a pattern of low entropy in the first 16 bytes, suggesting automated generation with a shared packing routine. Additionally, the single .2826 file appears to be a renamed executable with a valid Authenticode signature from a previously unseen certificate, which may allow it to bypass application control policies. SOC teams should add the certificate thumbprint to a blocklist rather than relying solely on file extension filters.
Security Analysis
The simultaneous jump in JS-based loaders and C2 server count points to a coordinated campaign rather than organic malware spread. The use of a freshly minted Authenticode certificate is a notable departure from AsyncRAT campaigns earlier this year, which relied primarily on obfuscated scripts without signed payloads. This suggests the operator is investing in evading hash-based and reputation-based detections, likely in response to improved signature coverage on older variants.
Actionable recommendation: Deploy a JavaScript execution policy that requires scripts to run through a sandboxed or constrained interpreter for non-whitelisted origins, and enable script block logging on endpoints. Combine this with a one-time sweep of the 100 new C2 endpoints at the perimeter firewall, blocking them at the DNS and network layers to disrupt the command channel before the campaign matures further.