# AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery (AsyncRAT/VenomRAT/XWorm)

> An active phishing campaign uses German-language invoice lures with Dropbox links to deliver AsyncRAT, VenomRAT, and XWorm via TryCloudflare-tunneled infrastructure. A .URL/.LNK chain triggers PowerShell to pull a JavaScript and Python package that uses ctypes to perform Early Bird APC Queue shellcode injection into notepad.exe and explorer.exe.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1114
- **ID:** TL-2026-1114
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Forcepoint X-Labs identified and reported (2026-07-02, blog title "AsyncRAT Reloaded: Python, TryCloudflare, Malware") a renewed wave of a phishing campaign it first documented in February 2025 ("Tweaking AsyncRAT: Hackers Using Python and TryCloudflare to Deploy Malware") and which itself resembles a campaign observed in August 2024. The current campaign begins with German-language, invoice-themed phishing emails containing a Dropbox URL. Clicking the link downloads a ZIP archive (SHA-1 55724b766dd1fe8bf9dd4cb7094b83b88d57d945) containing an internet shortcut (.URL) file (SHA-1 4483561a49791a7cd684258e9f1623fe7dfba772). Opening the .URL file connects to a TryCloudflare quick-tunnel address (inventory-card-thumbzilla-ip.trycloudflare.com/DE/) that hosts an .LNK file (SHA-1 0aa1b8fba8d7bd19a0064edfdf86c027da253644). The .LNK triggers PowerShell, which downloads and runs a JavaScript file (SHA-1 659ecdeb19b8e49be61fe41e8796d1215272b16e) over the same tunnel; the JavaScript deobfuscates and executes a heavily obfuscated batch (.BAT) file (SHA-1 cd61de9e4003ba568ae76f064935addb106a6d6d), which in turn retrieves a ZIP package (ma.zip, SHA-1 0221ec304905a758d9b47d6a631622b7dcf3c1f5) from a second TryCloudflare tunnel (mercy-synopsis-notify-motels.trycloudflare.com, with an HTTP fallback at sufficiently-points-est-minimize.trycloudflare.com). The ma.zip package contains a Python loader, load.py (SHA-1 4747ee49bdf31351c025049d8c3b7fef831be77c), that uses Python's ctypes module to call the Windows APIs VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and ResumeThread against newly created, suspended target processes — the classic "Early Bird APC Queue" injection technique (MITRE T1055.004), which queues malicious shellcode into a process's primary thread before that thread begins executing, reducing the window in which AV/EDR hooks can intercept it. A bundled portable Python 3.x interpreter ships alongside load.py so the chain executes even on hosts lacking a native Python install. Depending on which of five observed shellcode/.BIN binaries is executed (SHA-1s 8ef36a4865f4a73a4e8fe4b90e5eff4a7feb3647, ae1dece09c2b627d8d3fe1c1f758db9ca6d5820c, 8dc9071a46a019547c8355a155d9c3c3b154e7a2, ff6186eef1c17a2668c6013d38fecead4f507556, 098c369c904e8c328df40062190aff009e02d369), the loader injects VenomRAT (via a binary tracked as payload.bin) into notepad.exe, or injects AsyncRAT (most .bin files) or XWorm (via a binary tracked as xr.bin) shellcode into explorer.exe. Throughout execution the victim is shown a fake, legitimate-looking PDF invoice decoy to mask the background installation.

The campaign is notable primarily for its abuse of trusted, legitimate cloud infrastructure (Dropbox for initial hosting, Cloudflare's TryCloudflare quick tunnels for payload staging and callback) specifically because, per Forcepoint, "most security tools rarely block" traffic to these platforms — validating Forcepoint's 2025 Future Insights prediction that adversaries would increasingly abuse legitimate infrastructure to evade detection. Forcepoint's C2 telemetry for this wave records callback infrastructure at 62.60.190.141 (ports 3232 and 4056) and a secondary IP, 62.60.190.196; both addresses fall within the 62.60.190.0/24 block registered to VUNIFY LTD (AS210814, RIPE region).

The August 2024 precursor campaign Forcepoint references used a different initial-access vector: HTML email attachments abused the Windows search-ms: URI protocol handler to point victims at a TryCloudflare-hosted WebDAV share, from which malicious LNK and Python payloads were retrieved. The January/February 2025 wave ("Tweaking AsyncRAT") and the current July 2026 wave instead shifted to the Dropbox-ZIP-plus-.URL/.LNK delivery chain described above. This shows iterative evolution of the initial-access mechanism across the campaign's lifespan, while the Python/ctypes Early Bird injection payload and the AsyncRAT/VenomRAT/XWorm RAT selection have remained consistent across all three observed waves.

AsyncRAT, VenomRAT (a modified/forked Quasar RAT derivative), and XWorm are all mature, actively-traded commodity .NET/MSIL Remote Access Trojans with overlapping but distinct feature sets: keylogging, screen/audio capture, browser credential and cryptocurrency-wallet theft, file exfiltration, remote shell, registry/scheduled-task persistence, Defender/AMSI/ETW evasion, encrypted (frequently AES) C2 channels, and — in XWorm's case — DDoS/botnet tasking. Family-level technical analyses of XWorm document additional capabilities relevant to detection engineering even though Forcepoint's reporting on this specific wave did not confirm every secondary module was dropped: XWorm builds generate a unique client-fingerprint ID by hashing processor count, username, machine name, OS version, and drive size (system information discovery); a TCPConnections.dll module enumerates active TCP sessions with associated process IDs and connection state (network connection discovery); persistence is additionally achieved via Logon Script registry entries, and some builds carry a ResetConfig.xml mechanism that re-infects the host through C:\\Recovery\\OEM\\install.cmd, surviving a Windows factory reset; PowerShell-delivered stages disable AMSI (Antimalware Scan Interface) immediately on execution; a Merged.dll credential-theft module specifically targets Chrome, Edge, and Brave for cookies, saved passwords, and stored payment-card data; and some XWorm builds carry a Ransomware.dll module implementing AES-CBC file encryption keyed off the generated client ID, alongside a modular plugin system (SavePlugin/SendPlugin/RemovePlugins pipe-delimited commands, Base64+Gzip-compressed transport). No CVE or software vulnerability is involved; this is a social-engineering-driven malware delivery campaign targeting Windows endpoints, with the /DE/ URL path and German-language lure indicating a DACH-region (Germany/Austria/Switzerland) focus.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1037 Boot or Logon Initialization Scripts
- T1055 Process Injection
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1049 System Network Connections Discovery
- T1056 Input Capture
- T1113 Screen Capture
- T1123 Audio Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1498 Network Denial of Service
- T1486 Data Encrypted for Impact

## Sources

- [AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery](https://cybersecuritynews.com/asyncrat-campaign-abuses-trycloudflare-tunnels/)
- [AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again](https://www.forcepoint.com/blog/x-labs/asyncrat-reloaded-python-trycloudflare-malware)
- [Tweaking AsyncRAT: Hackers Using Python and TryCloudflare to Deploy Malware](https://www.forcepoint.com/blog/x-labs/asyncrat-python-trycloudflare-malware)
- [Phishing Campaign Uses Fake Invoice PDF to Drop AsyncRAT, VenomRAT, and XWorm](https://gbhackers.com/phishing-campaign-uses-fake-invoice-pdf/)
- [Hackers Use Dropbox URLs and TryCloudflare Tunnels to Deliver AsyncRAT Malware](https://cyberpress.org/dropbox-tunnels-deliver-asyncrat/)
- [AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery (mirror)](https://www.cryptika.com/asyncrat-campaign-abuses-trycloudflare-tunnels-and-python-scripts-for-malware-delivery/)
- [AsyncRAT Abusing Python and TryCloudflare For Stealthy Malware Delivery](https://cybersecuritynews.com/asyncrat-abusing-python-and-trycloudflare/)
- [AsyncRAT Exploiting Python and TryCloudflare for Covert Malware Distribution](https://cyberpress.org/asyncrat-exploiting-python-and-trycloudflare/)
- [AsyncRAT Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/asyncrat)
- [ScrubCrypt Deploys VenomRAT with an Arsenal of Plugins](https://www.fortinet.com/blog/threat-research/scrubcrypt-deploys-venomrat-with-arsenal-of-plugins)
- [Venom Control – RAT With a Sting](https://cyberint.com/blog/research/venom-control-rat-with-a-sting/)
- [VenomRAT: Windows Remote Access Trojan Analysis](https://hunt.io/malware-families/venomrat)
- [XWorm v7 RAT: Technical Analysis of Infection Chain, C2 Protocol, and Plugin Architecture](https://gurucul.com/latest-threats/xworm-v7-rat-technical-analysis-of-infection-chain-c2-protocol-and-plugin-architecture/)
- [Early Bird APC Queue Code Injection](https://www.ired.team/offensive-security/code-injection-process-injection/early-bird-apc-queue-code-injection)
- [Process Injection: Asynchronous Procedure Call, Sub-technique T1055.004](https://attack.mitre.org/techniques/T1055/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1114