Fortinet Details AI-Themed Lures Delivering AsyncRAT Through a Multistage Windows Infection Chain
Summary
Fortinet describes a Windows malware campaign using AI-themed document lures and staged scripts to install AsyncRAT and another .NET RAT, establish persistence, evade defenses, and communicate with attacker-controlled servers.
Key points
- The campaign uses AI-related learning materials as lures in compressed archives containing a malicious LNK shortcut and hidden files.
- The infection chain extracts and decrypts payloads from disguised file containers using staged CMD and PowerShell scripts.
- AutoHotkey loaders inject reconstructed .NET payloads into legitimate processes, while scheduled tasks and a VBS-based chain provide layered persistence.
- One stage adds the system drive and PowerShell to Microsoft Defender exclusions and restores Windows Script Host functionality.
- The final RATs support remote commands, screenshots, updates, self-deletion, and in-memory assembly loading; the article also identifies an AsyncRAT C2 IP and several domains.
- Fortinet says its antivirus and web-filtering services detect or block components and infrastructure associated with the campaign.
Article Details
- Attack Vectors
- A 7z archive disguised as an AI-related technical resource contains an LNK shortcut and hidden files; opening the shortcut starts a multi-stage infection chain.
- The chain uses staged PowerShell scripts and disguised file containers to extract and execute payloads, establish scheduled-task persistence, and deploy RATs.
- AutoHotkey scripts reconstruct a PE payload and inject it into a suspended .NET process; another branch weakens Microsoft Defender exclusions and restores Windows Script Host functionality.
- Defensive Notes
- Exercise caution with LNK files, compressed archives, and documents from untrusted sources.
- Audit startup entries, scheduled tasks, and registry keys for unauthorized modifications.
- Monitor for anomalous PowerShell execution and unexpected outbound network connections.
- Fortinet reports that up-to-date FortiGuard Antivirus signatures detect and block the described malware components, and that FortiGuard Web Filtering blocks the C2 server.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | shampobiskworld[.]nl | C2 domain listed for the modular RAT. |
| DOMAIN | shampoolagtto[.]com | C2 domain listed for the modular RAT. |
| DOMAIN | shamppocosmaticso[.]com | C2 domain listed for the modular RAT. |
| IPV4 | 107[.]172[.]10[.]190 | C2 address reported for the AsyncRAT payload. |
| SHA256 | 61b7fa5a7186cbf73dbc1f03e6e6f6819f5eb1e630a001059d381114bda2f974 | Hash listed for the malicious LNK. |
| SHA256 | 7d6ee3c6ff8f70b1817aaec82aff1d2babe0b62cafef3975262644743afc0cb8 | Hash listed for a malicious PowerShell artifact. |
| SHA256 | 96b486bd7308ef3d6771360800f4c9b48b10697bd4cb69a8589b97b039377ecb | Hash listed for a malicious executable. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationPayloads and scripts are concealed in disguised containers, encoded data regions, and obfuscated scripts, with strings and API names reconstructed at runtime.T1041 · Exfiltration Over C2 ChannelThe RAT sends victim information and screenshot data to its C2 over its communications channel.T1053.005 · Scheduled TaskThe scripts establish persistence by registering scheduled tasks, including tasks that run at logon, startup, and daily.T1055.012 · Process HollowingThe loader creates a suspended .NET process, replaces its image with the reconstructed payload, and resumes the thread; the RAT also describes a RunPE process-hollowing command.T1059.001 · PowerShellThe infection chain extracts and executes multiple PowerShell scripts, including scripts invoked with hidden-window and execution-policy-bypass options.T1113 · Screen CaptureThe RAT captures screenshots using Graphics.CopyFromScreen and sends the image data to its C2.T1562.001 · Disable or Modify ToolsA PowerShell stage adds C:\ to Microsoft Defender exclusions and excludes powershell.exe.T1620 · Reflective Code LoadingThe chain loads a .NET assembly from bytes in memory using Assembly.Load and invokes its entry point.
Malware
Vendors
Products
FortiClientThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.FortiEDRThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.FortiGateThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.FortiMailThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.Microsoft DefenderIt uses an elevated PowerShell process with runas to call Add-MpPreference, adding C:\ to Microsoft Defender’s exclusion paths and adding powershell.exe to Defender’s excluded processes.Microsoft WindowsAffected Platforms: Microsoft Windows