Darktrace Blocks Suspected AsyncRAT Activity in Customer Network
Summary
Darktrace detected a customer device connecting to suspected AsyncRAT infrastructure in late 2024 and blocked suspicious connections, halting the compromise before sensitive data was exfiltrated.
Key points
- Darktrace observed a customer device connecting to suspected AsyncRAT endpoints, including 185.49.126[.]50 on port 6606.
- Repeated connections and an SSL certificate identifying “CN=AsyncRAT Server” supported the suspected AsyncRAT association.
- The device later connected to 195.26.255[.]81 on ports including AsyncRAT defaults 6606, 7707, and 8808.
- Further suspicious connections involved kashuub[.]com and 191.96.207[.]246 on port 8041; the article describes these as possible command-and-control infrastructure.
- Darktrace’s Autonomous Response blocked connections to the suspicious endpoints; the company says this halted the compromise before sensitive data was exfiltrated.
- The article notes AsyncRAT capabilities including keylogging, file search, remote audio and camera access, and checks for VMware and VirtualBox environments.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- AsyncRAT infection with suspected command-and-control activity
- Incident Date
- 2024-12-20
- Disclosure Date
- 2025-05-13
- Operational Impact
- Darktrace blocked suspicious connections and reported that its intervention halted the compromise. The article says no sensitive data was exfiltrated.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | kashuub[.]com | Listed as a likely AsyncRAT C2 endpoint. |
| IPV4 | 185[.]49[.]126[.]50 | Identified by Darktrace as an AsyncRAT C2 endpoint. |
| IPV4 | 191[.]96[.]207[.]246 | Listed as a likely AsyncRAT C2 endpoint. |
| IPV4 | 195[.]26[.]255[.]81 | Identified by Darktrace as an AsyncRAT C2 endpoint. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolListed in the article's MITRE ATT&CK mapping.T1041 · Exfiltration Over C2 ChannelExfiltration over a C2 channel is listed in the article's MITRE ATT&CK mapping; the article says no data was exfiltrated in this incident.T1053 · Scheduled Task/JobScheduled task persistence is described.T1056 · Input CaptureKeylogging is described.T1057 · Process DiscoveryListed in the article's MITRE ATT&CK mapping.T1082 · System Information DiscoveryListed in the article's MITRE ATT&CK mapping.T1105 · Ingress Tool TransferListed in the article's MITRE ATT&CK mapping.T1125 · Video CaptureRemote camera access is described.T1219 · Remote Access ToolsListed in the article's MITRE ATT&CK mapping.T1497 · Virtualization/Sandbox EvasionAsyncRAT checks for virtual machine and sandbox indicators.
Malware
Vendors
Products
Darktrace / NETWORKFigure 1: Model alert in Darktrace / NETWORK showing the repeated SSL connections to a rare external Self-Signed endpoint, 185.49.126[.]50.Following these initial connections, the device was observed making aDarktrace Autonomous Responseto quickly detect the developing threat and alert on unusual behaviors, it was ultimately Darktrace Autonomous Response's consistent blocking of suspicious connections that prevented a more disruptive attack.