S1087: AsyncRAT
Security context for executives and security teams
S1087: AsyncRAT describes [AsyncRAT](https://attack.mitre.org/software/S1087) is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.(Citation: Morphisec Snip3 May 2021)(Citation: Cisco Operation Layover September 2021)(Citation: Telefonica Snip3 December 2021)
Executive priority
S1087: AsyncRAT is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1087: AsyncRAT by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1087: AsyncRAT appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
AsyncRAT
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1622 | Debugger Evasion | |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | AsyncRAT can be deployed via batch script.CitationESET MirrorFace 2025 |
| Enterprise | T1106 | Native API | |
| Enterprise | T1124 | System Time Discovery | AsyncRAT can check whether the current system hour and day of the week are within operating hours defined it its configuration.CitationESET MirrorFace 2025 |
| Enterprise | T1568.002 | Domain Generation AlgorithmsSub-technique | AsyncRAT use a DGA to generate a C2 domains.CitationESET MirrorFace 2025 |
| Enterprise | T1090.003 | Multi-hop ProxySub-technique | |
| Enterprise | T1680 | Local Storage Discovery | |
| Enterprise | T1033 | System Owner/User Discovery | |
| Enterprise | T1566.001 | Spearphishing AttachmentSub-technique | AsyncRAT has been delivered via malicious email attachments.CitationRecorded Future TAG-144 AUG 2025 |
| Enterprise | T1568 | Dynamic Resolution | AsyncRAT can be configured to use dynamic DNS.CitationAsyncRAT GitHub |
| Enterprise | T1564.003 | Hidden WindowSub-technique | |
| Enterprise | T1497.001 | System ChecksSub-technique | |
| Enterprise | T1125 | Video Capture | AsyncRAT can record screen content on targeted systems.CitationAsyncRAT GitHub |
| Enterprise | T1105 | Ingress Tool Transfer | AsyncRAT has the ability to download files including over SFTP.CitationAsyncRAT GitHubCitationESET MirrorFace 2025 |
| Enterprise | T1204.002 | Malicious FileSub-technique | AsyncRAT has been executed through victims opening malicious file attachments.CitationRecorded Future TAG-144 AUG 2025 |
| Enterprise | T1057 | Process Discovery | |
| Enterprise | T1016 | System Network Configuration Discovery | AsyncRAT can enumerate the NetBIOS name on targeted machines.CitationESET MirrorFace 2025 |
| Enterprise | T1113 | Screen Capture | AsyncRAT has the ability to view the screen on compromised hosts.CitationAsyncRAT GitHub |
| Enterprise | T1056.001 | KeyloggingSub-technique | AsyncRAT can capture keystrokes on the victim’s machine.CitationAsyncRAT GitHub |
| Enterprise | T1053.005 | Scheduled TaskSub-technique |
Groups, software, and campaigns
G1018: TA2541
TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]
G0099: APT-C-36
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]
C0060: Operation AkaiRyū
Operation AkaiRyū (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by MirrorFace between June and September 2024 against entities in Japan and Central Europe. Operation AkaiRyū notably included the first reported targeting of a European entity by MirrorFace, as well as their use of UPPERCUT, which was thought to be exclusive to menuPass.[1][2]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.0 | Current bundle | 3df7c39cce79… | ||
| 19.2 | 1.0 | Older bundle | 3df7c39cce79… | ||
| 19.1 | 1.0 | Older bundle | 3df7c39cce79… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Morphisec Snip3 May 2021
Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.
Open source URL - [2]Cisco Operation Layover September 2021
Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.
Open source URL - [3]Telefonica Snip3 December 2021
Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.
Open source URL - [4]mitre-attackS1087Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.