Daily Summary
AsyncRAT activity climbed to 44 new samples today, a 66% surge over the 7-day average of 26 and the highest single-day volume observed in the past eight days. The increase was driven primarily by a sharp uptick in JavaScript-based loaders, which accounted for 15 of today’s samples versus a typical 3-5 per day. Distribution and infrastructure also expanded in tandem, with 100 new C2 servers registered and 144 new IOCs added to tracking.
New Samples Detected
The file type distribution shifted notably away from the usual executable-heavy mix. While 18 .exe samples remain the largest category, JavaScript (.js) loaders surged to 15 samples, more than double the 7-day average for that format. The remaining breakdown included 3 .zip archives, 2 .bat scripts, 2 .bin payloads, 2 .hta files, 1 .vbs script, and 1 .7z archive.
The presence of 4 script-based delivery formats (.js, .bat, .hta, .vbs) totaling 20 samples suggests an operational preference for living-off-the-land execution chains rather than direct binary execution. Several .js samples observed today follow a familiar pattern of downloading a second-stage payload from a hardcoded URL and executing it via WScript.Shell, a technique consistent with recent phishing lures but deployed at higher volume than in prior weeks.
Distribution Methods
No single phishing campaign or delivery vector stood out as the source of today’s volume, which is itself notable. The distribution appears fragmented: the mix of archive formats (.zip, .7z) alongside script loaders points to multiple concurrent campaigns rather than one centralized spam run. The .js files, in particular, are frequently delivered as email attachments disguised as invoice or shipping notices, though no single sender infrastructure was common across today’s samples.
C2 Infrastructure
Today saw 100 new C2 servers associated with AsyncRAT, a substantial expansion that outpaces the sample volume. This ratio of roughly 2.3 new C2 servers per sample suggests the operators are cycling infrastructure aggressively, likely to maintain resilience ahead of any takedown efforts. The IP and domain registrations observed were spread across multiple hosting providers in Europe and North America, with no geographic clustering that would indicate a single hosting provider dependency.
IOC Highlights
Of the 144 new IOCs logged today, 3 C2 domains warrant specific attention: kleopatra-logistics[.]com, mercury-express[.]info, and atlas-freight-solutions[.]net. All three follow a shipping-themed naming convention that matches the phishing lures commonly used for .js delivery, reinforcing the link between today’s loader surge and these newly registered domains. Also notable are 5 identical SHA256 hashes across different .js samples that resolved to the same download URL, indicating the samples were likely generated from the same template with only minor obfuscation changes.
7-Day Trend
Today’s 44 samples represent a 69% increase over the 7-day average of 26, marking the first significant deviation from the relatively stable 22-30 samples per day seen earlier this week. The last time AsyncRAT volume exceeded 40 samples in a single day was 9 days ago, and that spike was also driven by script-based loaders. This suggests a cyclical pattern where operators alternate between binary-heavy weeks and loader-heavy surges every 7-10 days, making today’s volume less an anomaly and more an indicator of the current operational phase.
Security Analysis
The 2.3:1 ratio of new C2 servers to samples is the most striking metric today, indicating that infrastructure provisioning is outpacing sample distribution. This is consistent with operators preparing for a longer campaign, rotating C2s to evade domain blocklists before they are widely published. The correlation between shipping-themed C2 domains and the .js loader surge suggests a coordinated operation: the loaders are built to connect specifically to the newly registered domains, not random fallbacks.
Defensive teams should prioritize blocking the three shipping-themed domains listed in IOC Highlights immediately, then deploy YARA rules targeting the common template fragments shared across today’s .js samples. Since 5 samples resolved to the same download URL despite different hashes, static detection will lag; behavioral detections triggering on WScript.Shell execution followed by HTTP download calls will be more durable against this variant cycle.