Daily Summary
AsyncRAT telemetry shows 27 new samples for 2026-10-11, roughly in line with the 7-day average of 25 (up 9%). Activity is stable, with no surge or decline worth flagging on volume alone. The more interesting signal is infrastructure: 80 new C2 servers and 107 new IOCs against a flat sample count suggests operators are rotating command infrastructure faster than they are pushing new builds.
New Samples Detected
File type distribution is skewed toward script-based loaders: 13 .js, 3 .vbs, and 1 .bat account for 17 of 27 samples (63%), with 10 .exe binaries making up the remainder. This is the familiar two-stage pattern for AsyncRAT, where a script stager handles initial execution and environment checks before fetching or dropping the .NET payload. The 10 standalone executables are worth watching, since AsyncRAT binaries distributed without a script wrapper are sometimes repackaged builds with modified strings or different persistence logic. No filenames or hashes are available in this feed, so attribution to a specific builder or campaign is not possible from the sample set alone.
C2 Infrastructure
The ratio of 80 new C2 servers to 27 new samples is the standout metric today. Roughly three new C2 endpoints per new sample is high for AsyncRAT, which more commonly reuses long-lived panels across many victims. Two readings are plausible: either multiple operators are standing up infrastructure simultaneously, or a single operator is running deliberate fast-flux style rotation to stay ahead of blocklists. The 107 new IOCs (combined C2 and sample indicators) will need triage to determine how many are genuinely distinct versus shared hosting ranges.
IOC Highlights
With 80 new C2 servers and 107 new IOCs, this is the dataset that matters most today. Given the volume, defenders should expect clustering on common bulletproof hosting ASNs and cheap VPS providers rather than unique, bespoke domains per campaign. That clustering is useful: blocklisting at the ASN or netblock level may cover more of the new infrastructure than individual domain blocks, which operators can abandon cheaply.
Security Analysis
The pattern here, flat sample volume paired with heavy C2 rotation, matches what we see when an established AsyncRAT operator (or small cluster of them) prioritizes operational resilience over new tooling. The payload itself is not evolving today; the delivery and command layer is. This is consistent with the broader AsyncRAT trend over the past two quarters, where the open-source builder has stabilized and competition has shifted to infrastructure hygiene and loader craft.
Actionable recommendation: rather than chasing 80 individual C2 entries, prioritize hunting for the script-loader behavior on endpoints, specifically .js and .vbs files spawning wscript, cscript, or mshta and then initiating outbound HTTPS to recently registered domains. A behavioral detection on that parent-child chain will catch the next infrastructure rotation even when the specific C2 list goes stale, which, at this rotation rate, it will within days.