Daily Summary
AsyncRAT detections totaled 24 new samples on 2026-08-30, a 24% decline from the 7-day average of 32. This marks the third consecutive day of below-average volume, though the drop is not yet severe enough to signal campaign abandonment. The decline is driven entirely by a reduction in .js payloads, which fell from a typical 22-per-day average to 18.
New Samples Detected
The file-type distribution continues to skew heavily toward script-based delivery, with 18 .js files (75%), 5 .exe files (21%), and 1 .vbs file. The .exe count is notably at the low end of the observed range - the 7-day average for executables is 8 per day. This shift suggests threat actors are favoring JavaScript loaders that fetch the final AsyncRAT payload in memory, likely to bypass static scanning of executables at email gateways. The single .vbs sample is an outlier; VBScript usage has been sporadic this week (0-2 per day) and does not indicate a broader pivot.
C2 Infrastructure
A substantial churn was observed on the C2 side: 100 new C2 servers were logged, a significant increase relative to the declining sample volume. This translates to roughly 4.2 new C2 servers per sample, well above the 7-day ratio of 2.8. The inflated C2 count relative to new samples suggests operators may be pre-staging infrastructure for a future campaign push, or are rotating domains more aggressively to evade domain-based blocking. A portion of these new C2 entries appear to be throwaway domains registered within the last 48 hours, consistent with fast-flux patterns seen in prior AsyncRAT operations.
IOC Highlights
124 new IOCs were published today, including 100 C2 domains/IPs, 18 hashes for the .js samples, 5 hashes for the .exe variants, and 1 hash for the .vbs file. Analysts should note that 12 of the 18 .js hashes share a common obfuscation routine - base64-encoded strings with a fixed XOR key of 0x5A - which aligns with a builder configuration observed in recent AsyncRAT phishing lures. The malware does not appear to be packed; the .exe samples are plain compiled AutoIt wrappers, which is unusual for the current threat landscape where packing is the norm.
Security Analysis
The C2-to-sample ratio is the most telling metric today. A 100-new-server count against a declining sample volume indicates operators are preparing a larger wave, likely timed to coincide with post-Labor Day phishing campaigns in North America. Historically, AsyncRAT operators have used quiet periods to bulk-register domains and stage malicious infrastructure before a spike in email-lure campaigns. SOC teams should preemptively block the newly published C2 domains and implement YARA rules targeting the generic XOR-0x5A obfuscation seen in the .js loaders, as this signature will likely carry over to the next wave of samples.