AsyncRAT: a large-scale cyber breach

In the sphere of cybersecurity, a massive infiltration operation was detected and monitored for over 11 months. The protagonist of this offensive scheme is AsyncRAT, a RAT (Remote Access Tool) tool designed for Windows operating systems and released in 2019. AsyncRAT is known for its ability to execute remote commands, intercept keystrokes (keylogging), steal data and deliver additional payloads without the knowledge of end users. Cyber attackers have used this utility in both pure and altered forms to infiltrate and compromise target systems, perform intelligence gathering activities, and spread other malware elements.

Meticulous selection of victims and attack methods

According to the report by Alien Labs, AT&T's research department, the attack campaign was highlighted last September for the acumen in the selection of its victims: carefully vetted individuals and organizations, many of whom managed critical infrastructures on US soil. The deception begins with insidious emails that included GIF attachments, which redirect users to SVG files that trigger the execution of intentionally disguised JavaScript and PowerShell scripts to avoid detection in the preliminary stages of the attack.

The tactic implemented to avoid detection

The primary vehicle for AsyncRAT is a downloader that engages direct communication with a command and control (C2) server to validate the susceptibility of the targeted system to infection. These downloaders, which use a series of C2 domains with encrypted and anonymous payments through the BitLaunch service, are programmed to disclose diversionary payloads if they detect they are in environments dedicated to analytics. A deliberate tactic to mislead researchers and mask malicious activity from cyber intelligence tools.

Anti-sandboxing and attack diversification

The architect of your bootloader performs meticulous checks via PowerShell to identify the use of virtual machines and other protected environments. These checks aim to generate a 'score' based on which the next action is decided. Attackers have been observed to have introduced at least 300 distinct bootloader variants, each with slight variations in code, obfuscation techniques, and parameters to evade detection algorithms and maintain attack effectiveness.