AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery (AsyncRAT/VenomRAT/XWorm)

AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python (TL-2026-1114), also tracked as AsyncRAT Reloaded, is a high-severity malware campaign, first published 2026-07-02. It has no confirmed attribution, affects Microsoft Windows (Desktop and Server), maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 34 indicators of compromise.

Key facts for TL-2026-1114

Threat ID
TL-2026-1114
Also known as
AsyncRAT Reloaded, Tweaking AsyncRAT
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-02
Last reviewed
2026-07-02
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
unspecified broad opportunistic phishing distribution no sector-specific targeting reported by researchers
Target regions
germany, DACH region (German-speaking Europe, inferred from German-language lure and /DE/ URL path)
Detection rules
9
Indicators of compromise
34

Malware and tooling in AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python

Malware and tooling: AsyncRAT, Venom RAT, XWorm

An active phishing campaign uses German-language invoice lures with Dropbox links to deliver AsyncRAT, VenomRAT, and XWorm via TryCloudflare-tunneled infrastructure. A .URL/.LNK chain triggers PowerShell to pull a JavaScript and Python package that uses ctypes to perform Early Bird APC Queue shellcode injection into notepad.exe and explorer.exe.

How AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python works

Forcepoint X-Labs identified and reported (2026-07-02, blog title "AsyncRAT Reloaded: Python, TryCloudflare, Malware") a renewed wave of a phishing campaign it first documented in February 2025 ("Tweaking AsyncRAT: Hackers Using Python and TryCloudflare to Deploy Malware") and which itself resembles a campaign observed in August 2024. The current campaign begins with German-language, invoice-themed phishing emails containing a Dropbox URL. Clicking the link downloads a ZIP archive (SHA-1 55724b766dd1fe8bf9dd4cb7094b83b88d57d945) containing an internet shortcut (.URL) file (SHA-1 4483561a49791a7cd684258e9f1623fe7dfba772). Opening the .URL file connects to a TryCloudflare quick-tunnel address (inventory-card-thumbzilla-ip.trycloudflare.com/DE/) that hosts an .LNK file (SHA-1 0aa1b8fba8d7bd19a0064edfdf86c027da253644). The .LNK triggers PowerShell, which downloads and runs a JavaScript file (SHA-1 659ecdeb19b8e49be61fe41e8796d1215272b16e) over the same tunnel; the JavaScript deobfuscates and executes a heavily obfuscated batch (.BAT) file (SHA-1 cd61de9e4003ba568ae76f064935addb106a6d6d), which in turn retrieves a ZIP package (ma.zip, SHA-1 0221ec304905a758d9b47d6a631622b7dcf3c1f5) from a second TryCloudflare tunnel (mercy-synopsis-notify-motels.trycloudflare.com, with an HTTP fallback at sufficiently-points-est-minimize.trycloudflare.com). The ma.zip package contains a Python loader, load.py (SHA-1 4747ee49bdf31351c025049d8c3b7fef831be77c), that uses Python's ctypes module to call the Windows APIs VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and ResumeThread against newly created, suspended target processes — the classic "Early Bird APC Queue" injection technique (MITRE T1055.004), which queues malicious shellcode into a process's primary thread before that thread begins executing, reducing the window in which AV/EDR hooks can intercept it. A bundled portable Python 3.x interpreter ships alongside load.py so the chain executes even on hosts lacking a native Python install. Depending on which of five observed shellcode/.BIN binaries is executed (SHA-1s 8ef36a4865f4a73a4e8fe4b90e5eff4a7feb3647, ae1dece09c2b627d8d3fe1c1f758db9ca6d5820c, 8dc9071a46a019547c8355a155d9c3c3b154e7a2, ff6186eef1c17a2668c6013d38fecead4f507556, 098c369c904e8c328df40062190aff009e02d369), the loader injects VenomRAT (via a binary tracked as payload.bin) into notepad.exe, or injects AsyncRAT (most .bin files) or XWorm (via a binary tracked as xr.bin) shellcode into explorer.exe. Throughout execution the victim is shown a fake, legitimate-looking PDF invoice decoy to mask the background installation.

The campaign is notable primarily for its abuse of trusted, legitimate cloud infrastructure (Dropbox for initial hosting, Cloudflare's TryCloudflare quick tunnels for payload staging and callback) specifically because, per Forcepoint, "most security tools rarely block" traffic to these platforms — validating Forcepoint's 2025 Future Insights prediction that adversaries would increasingly abuse legitimate infrastructure to evade detection. Forcepoint's C2 telemetry for this wave records callback infrastructure at 62.60.190.141 (ports 3232 and 4056) and a secondary IP, 62.60.190.196; both addresses fall within the 62.60.190.0/24 block registered to VUNIFY LTD (AS210814, RIPE region).

The August 2024 precursor campaign Forcepoint references used a different initial-access vector: HTML email attachments abused the Windows search-ms: URI protocol handler to point victims at a TryCloudflare-hosted WebDAV share, from which malicious LNK and Python payloads were retrieved. The January/February 2025 wave ("Tweaking AsyncRAT") and the current July 2026 wave instead shifted to the Dropbox-ZIP-plus-.URL/.LNK delivery chain described above. This shows iterative evolution of the initial-access mechanism across the campaign's lifespan, while the Python/ctypes Early Bird injection payload and the AsyncRAT/VenomRAT/XWorm RAT selection have remained consistent across all three observed waves.

AsyncRAT, VenomRAT (a modified/forked Quasar RAT derivative), and XWorm are all mature, actively-traded commodity .NET/MSIL Remote Access Trojans with overlapping but distinct feature sets: keylogging, screen/audio capture, browser credential and cryptocurrency-wallet theft, file exfiltration, remote shell, registry/scheduled-task persistence, Defender/AMSI/ETW evasion, encrypted (frequently AES) C2 channels, and — in XWorm's case — DDoS/botnet tasking. Family-level technical analyses of XWorm document additional capabilities relevant to detection engineering even though Forcepoint's reporting on this specific wave did not confirm every secondary module was dropped: XWorm builds generate a unique client-fingerprint ID by hashing processor count, username, machine name, OS version, and drive size (system information discovery); a TCPConnections.dll module enumerates active TCP sessions with associated process IDs and connection state (network connection discovery); persistence is additionally achieved via Logon Script registry entries, and some builds carry a ResetConfig.xml mechanism that re-infects the host through C:\\Recovery\\OEM\\install.cmd, surviving a Windows factory reset; PowerShell-delivered stages disable AMSI (Antimalware Scan Interface) immediately on execution; a Merged.dll credential-theft module specifically targets Chrome, Edge, and Brave for cookies, saved passwords, and stored payment-card data; and some XWorm builds carry a Ransomware.dll module implementing AES-CBC file encryption keyed off the generated client ID, alongside a modular plugin system (SavePlugin/SendPlugin/RemovePlugins pipe-delimited commands, Base64+Gzip-compressed transport). No CVE or software vulnerability is involved; this is a social-engineering-driven malware delivery campaign targeting Windows endpoints, with the /DE/ URL path and German-language lure indicating a DACH-region (Germany/Austria/Switzerland) focus.

MITRE ATT&CK techniques used in TL-2026-1114

Collection

T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information

Persistence

T1037 Boot or Logon Initialization Scripts; T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1049 System Network Connections Discovery; T1082 System Information Discovery

Privilege Escalation

T1055 Process Injection

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel

Impact

T1486 Data Encrypted for Impact; T1498 Network Denial of Service

Credential Access

T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Initial Access

T1566 Phishing

Resource Development

T1587 Develop Capabilities; T1608 Stage Capabilities

Reconnaissance

T1589 Gather Victim Identity Information

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python

  • Microsoft — Windows (Desktop and Server)
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2016 and later
    Fixed in: N/A — social-engineering malware delivery campaign, not a software vulnerability
  • Python Software Foundation — Python interpreter (abused as attacker-bundled portable runtime for ctypes-based injection)
    Vulnerable versions: Any attacker-bundled Python 3.x runtime used to execute load.py
    Fixed in: N/A

Remediation for AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python

Patches

  • No vendor patch applicable — this is a social-engineering malware delivery campaign, not a software vulnerability

Immediate actions

  • Block/alert on outbound connections to *.trycloudflare.com quick-tunnel subdomains, especially inventory-card-thumbzilla-ip.trycloudflare.com, mercy-synopsis-notify-motels.trycloudflare.com, and sufficiently-points-est-minimize.trycloudflare.com
  • Block or heavily monitor the known C2 IPs 62.60.190.141 (ports 3232/4056) and 62.60.190.196, and flag the surrounding 62.60.190.0/24 (AS210814, VUNIFY LTD) range
  • Hunt for and quarantine files matching the published SHA-1 hashes across endpoint and email-gateway telemetry
  • Alert on PowerShell child processes spawned from explorer.exe via .lnk/.url file execution, especially from files extracted from ZIP archives
  • Alert on notepad.exe or explorer.exe exhibiting anomalous remote memory operations (VirtualAllocEx/WriteProcessMemory/QueueUserAPC/ResumeThread from a Python or unexpected parent process)

Workarounds

  • Block direct execution of .url and .lnk files extracted from email or browser-downloaded ZIP archives via Group Policy/ASR rules
  • Restrict outbound access to Dropbox and *.trycloudflare.com for standard user endpoints where not business-required
  • Restrict PowerShell execution policy and Windows Script Host for standard users without an administrative business need

Longer-term hardening

  • Deploy EDR with behavioral detection tuned for APC-queue/Early Bird process injection (T1055.004) rather than signature-only AV
  • Enable PowerShell Script Block Logging and Module Logging (Event ID 4104) enterprise-wide
  • Restrict or closely monitor use of Cloudflare Quick Tunnels (trycloudflare.com) and similar tunneling services on corporate egress policy
  • Deliver user-awareness training specifically on German-language invoice-themed phishing and unsolicited ZIP/LNK/URL attachments
  • Implement application allowlisting to block execution of unauthorized/portable Python interpreters and unexpected .py/.bin payloads

Timeline of AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python

  • Forcepoint references an earlier AsyncRAT campaign (month-level precision only, August 2024) that used HTML email attachments abusing the Windows search-ms: URI protocol handler to point victims at a TryCloudflare-hosted WebDAV share serving malicious LNK and Python payloads — a distinct initial-access vector from the current wave, though the Python/ctypes injection payload and RAT selection are consistent.
  • Forcepoint X-Labs publishes 'Tweaking AsyncRAT: Hackers Using Python and TryCloudflare to Deploy Malware,' documenting the shift to a Dropbox -> TryCloudflare -> LNK -> PowerShell -> Python/ctypes injection chain, with C2 observed at 62.60.190.141:3232; The Hacker News and other outlets cover the same report the same week.
  • Threadlinqs threat-hunting pipeline ingests the campaign as TL-2026-1114 based on the Cyber Security News feed article, confirming an active, multi-payload RAT delivery chain against Windows endpoints.
  • Cyber Security News, GBHackers, Cyberpress, and Cryptika publish independent same-day coverage summarizing the Forcepoint findings and IOC set.
  • Forcepoint X-Labs publishes 'AsyncRAT Reloaded: Python, TryCloudflare, Malware,' detailing the full infection chain, Early Bird APC Queue injection into notepad.exe/explorer.exe, and file hashes for the ZIP, URL, LNK, JS, BAT, ma.zip, load.py, and shellcode binaries.
  • Forcepoint X-Labs identifies the renewed 'AsyncRAT Reloaded' campaign using German-language invoice phishing lures to deliver AsyncRAT, VenomRAT, and XWorm via TryCloudflare-tunneled infrastructure.
  • Depending on the injected .bin, VenomRAT is deployed in notepad.exe, or AsyncRAT/XWorm is deployed in explorer.exe, while a decoy PDF invoice is displayed to the victim to mask the background installation.
  • load.py uses ctypes to call VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and ResumeThread, performing Early Bird APC Queue injection (T1055.004) of one of five observed shellcode/.BIN binaries into a suspended notepad.exe or explorer.exe process.
  • The batch file retrieves ma.zip (SHA-1 0221ec304905a758d9b47d6a631622b7dcf3c1f5) from the second TryCloudflare tunnel mercy-synopsis-notify-motels.trycloudflare.com (with HTTP fallback at sufficiently-points-est-minimize.trycloudflare.com), extracting the Python loader load.py (SHA-1 4747ee49bdf31351c025049d8c3b7fef831be77c) and bundled Python runtime.
  • PowerShell downloads and runs a JavaScript file (SHA-1 659ecdeb19b8e49be61fe41e8796d1215272b16e) over the same tunnel; the JavaScript deobfuscates and executes a heavily obfuscated batch file (SHA-1 cd61de9e4003ba568ae76f064935addb106a6d6d).
  • Opening the .URL file connects to the TryCloudflare quick-tunnel inventory-card-thumbzilla-ip.trycloudflare.com/DE/, which serves a malicious .LNK file (SHA-1 0aa1b8fba8d7bd19a0064edfdf86c027da253644) that triggers PowerShell.
  • Victim clicks the Dropbox link and downloads a ZIP archive (SHA-1 55724b766dd1fe8bf9dd4cb7094b83b88d57d945) containing an internet shortcut (.URL) file (SHA-1 4483561a49791a7cd684258e9f1623fe7dfba772).
  • German-language, invoice-themed phishing emails containing a Dropbox link are delivered to victims, beginning the current 'AsyncRAT Reloaded' wave observed by Forcepoint.

Sources cited for AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python

Threats related to AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python

Detection coverage for TL-2026-1114

As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1114 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats