{
  "Event": {
    "analysis": "1",
    "date": "2026-06-11",
    "extends_uuid": "",
    "info": "[Threat Intel] Threat Actors Weaponize AI Hype to Deliver AsyncRAT",
    "protected": false,
    "publish_timestamp": "1782058558",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782058558",
    "uuid": "a72101e4-904d-4526-b9e3-6e902513f24b",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#7223eb",
        "local": false,
        "name": "misp-galaxy:producer=\"Fortinet\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#1cbe6b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4bc785",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"AsyncRAT\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578815",
        "to_ids": false,
        "type": "link",
        "uuid": "1f1897f2-5cc0-464f-a6d6-03fc6378d03e",
        "value": "https://www.fortinet.com/blog/threat-research/threat-actors-weaponize-ai-hype-to-deliver-asyncrat"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578815",
        "to_ids": false,
        "type": "text",
        "uuid": "200d67a5-3cb0-4c7f-96d8-b488ed74d2bf",
        "value": "A sophisticated malware campaign exploits growing interest in artificial intelligence by distributing malicious files disguised as AI-related learning resources and technical guides. The attack employs an exceptionally complex multi-stage infection chain beginning with compressed archives containing LNK shortcuts and hidden PDF files. Through multiple layers of obfuscation involving PowerShell scripts, batch files, and AutoHotkey loaders, the campaign establishes persistent access and deploys two distinct .NET Remote Access Trojans including AsyncRAT. The intermediate scripts extensively use Simplified Chinese variable names and exhibit coding patterns suggesting AI-assisted development, with cultural references to Chinese mythology used as symbolic aliases for Windows API calls. The attack implements advanced techniques including process hollowing, reflective DLL injection, and scheduled task persistence while actively disabling Windows Defender exclusions to facilitate execution."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578815",
        "to_ids": false,
        "type": "text",
        "uuid": "64a757d7-6ba5-48d6-bc35-4ff8613a8e40",
        "value": "Name: Threat Actors Weaponize AI Hype to Deliver AsyncRAT\nAuthor: AlienVault\nAdversary: \nTags: [\"multi-stage infection\", \"scheduled tasks\", \"autohotkey\", \"ai-themed lures\", \"asyncrat\", \"chinese threat actor\", \"reflective injection\", \"process hollowing\"]\nTgtd countries: []\nMlwr families: [\"AsyncRAT\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1218.011\", \"T1573.001\", \"T1082\", \"T1106\", \"T1140\", \"T1112\", \"T1497\", \"T1204\", \"T1059.001\", \"T1566\", \"T1562.001\", \"T1055.012\", \"T1027\", \"T1059.003\", \"T1070.004\", \"T1071.001\", \"T1059.005\"]\nIndustries: []"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:21/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782033599",
        "to_ids": true,
        "type": "sha256",
        "uuid": "03d5a31f-9815-455d-a110-f24ac9dc04f9",
        "value": "7d6ee3c6ff8f70b1817aaec82aff1d2babe0b62cafef3975262644743afc0cb8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:21/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782033600",
        "to_ids": true,
        "type": "sha256",
        "uuid": "dbc4268d-fecd-4f70-989e-90ab42b5bbb9",
        "value": "96b486bd7308ef3d6771360800f4c9b48b10697bd4cb69a8589b97b039377ecb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782040889",
        "to_ids": true,
        "type": "domain",
        "uuid": "42a29afd-a834-41ae-913b-8f67fa4fa794",
        "value": "shampobiskworld.nl",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782040910",
        "to_ids": true,
        "type": "domain",
        "uuid": "367b8358-f14d-457a-a397-6b3a0f710434",
        "value": "shampoolagtto.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782040931",
        "to_ids": true,
        "type": "domain",
        "uuid": "f0d6e51e-82d0-47f5-a58a-74d32a5b968f",
        "value": "shamppocosmaticso.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782040952",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "63ead111-7aee-4a4c-9267-88aeffe4f2bf",
        "value": "107.172.10.190",
        "Tag": [
          {
            "colour": "#6a53a7",
            "local": false,
            "name": "asn:asn=\"36352\"",
            "relationship_type": ""
          },
          {
            "colour": "#9daeac",
            "local": false,
            "name": "asn:as-owner=\"AS-COLOCROSSING\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782040973",
        "uuid": "7b52f22a-8851-4767-81e1-d50a625fac12",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782040973",
            "to_ids": true,
            "type": "md5",
            "uuid": "e5b9bf99-76b8-498b-852f-7c35f5a2dabc",
            "value": "264d883d87ccdd65d78059eee677990a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782033598",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6d5c7ff3-c8c5-451b-aea0-85ab6c5d7324",
            "value": "1d00e8ffb6fbd88eb0459cb52070c2c252a832bd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782033598",
            "to_ids": true,
            "type": "sha256",
            "uuid": "499fb918-3de1-42d7-a0ce-238b636b09af",
            "value": "61b7fa5a7186cbf73dbc1f03e6e6f6819f5eb1e630a001059d381114bda2f974",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782033318",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "39004799-2064-436d-a746-7824b8a4919f",
            "value": "24:8IJsPrYHdOOAeJ9UMeglVqyYqmyaDJd2Y4I0613C95A8zco1ltsdcvm9pRtrA8zm:8JEH+Asg3hYqmyNINe/dUDN/Vx4OK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782033318",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "159d9511-23d1-4aa8-9a79-9edd40c3c28f",
            "value": "2657"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782033318",
            "to_ids": true,
            "type": "vhash",
            "uuid": "9652734f-1c4f-4eea-94bf-8844d9624e37",
            "value": "e89531ac529bb52687d0cc6d16c85be2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782033318",
            "to_ids": true,
            "type": "filename",
            "uuid": "85f50790-f2e1-4966-9a29-9f917f0c9353",
            "value": "Agentic Coding with Claude Code The everyday developer's guide to agentic coding with Claude Code.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 21/06/2026\nLast-scan\t:  19/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782033318",
            "to_ids": false,
            "type": "text",
            "uuid": "8bfe3de1-a2b4-4e76-aed1-54f315e81585",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:33/62\nFirst Submission:2026-03-28T08:22:00.000000+00:00\nLast Submission:2026-04-11T20:53:43.000000+00:00"
          }
        ]
      }
    ]
  }
}