LiveActive security incident?Get immediate response
MITRE ATT&CK® Tool

S1087: AsyncRAT

AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.[1][2][3]

EnterpriseS1087ToolObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

AsyncRAT is a Windows remote access tool that is open source and has been reported by ATT&CK as used in malicious campaigns. Its business significance is not just the tool name: the mapped behaviors span user-driven execution, persistence with scheduled tasks, discovery, credential collection through keylogging, screen/video capture, file transfer, and command-and-control using dynamic resolution/proxying. That combination makes it relevant to incident response readiness, phishing resilience, endpoint visibility, and evidence that SOC teams can follow an intrusion beyond the initial file execution.

Executive priority

Treat AsyncRAT coverage as a practical test of Windows endpoint and email-led intrusion resilience. Leaders should ask whether the organization can prove visibility from malicious attachment opening through persistence, discovery, credential capture, and outbound command-and-control. Because ATT&CK relates this tool to multiple campaigns/groups, including aviation/transportation-themed TA2541 activity and Operation AkaiRyū, it is useful for threat-informed control validation, but local exposure should be based on telemetry and business context rather than assuming targeting.

Technical view

ATT&CK provides no official detection text for AsyncRAT, so defenders should build validation around the mapped techniques and the Windows platform. Prioritize visibility into suspicious file execution from email/download paths, cmd.exe usage, scheduled task creation or modification, process/user/network/system-time/storage discovery, file ingress, screen or video capture behavior, keylogging indicators, hidden windows, native API-heavy execution patterns, and outbound C2 patterns involving dynamic DNS/DGA-like behavior or multi-hop proxy infrastructure. Relationships to T1566.001, T1204.002, T1053.005, T1059.003, T1056.001, T1113, T1125, T1105, T1090.003, T1568/T1568.002, and multiple discovery/evasion techniques should drive detection engineering test cases.

Likely telemetry

  • Email security logs and attachment detonation/opening records for spearphishing attachment scenarios
  • Windows process creation telemetry with command line, parent-child relationships, and user context
  • Scheduled task creation, modification, and execution events
  • Endpoint file creation/download telemetry for ingress tool transfer
  • DNS query logs, proxy logs, firewall/netflow, and outbound connection metadata

Detection direction

  • Do not rely on a single AsyncRAT signature; validate behavior chains across initial access, execution, persistence, discovery, collection, and C2.
  • Tune for suspicious scheduled tasks linked to recently delivered or user-opened files, unusual parent processes, or unexpected command-shell execution.
  • Correlate user-driven file execution with subsequent discovery activity, file transfer, screen/video capture, or keylogging indicators to reduce false positives.
  • Review DNS and egress analytics for dynamic resolution or DGA-like patterns, but account for legitimate dynamic services and proxy infrastructure.
  • Include anti-analysis blind spots in testing: system checks and debugger evasion may reduce sandbox visibility, so endpoint and network telemetry remain important.

Mitigation priorities

  • Start with phishing and malicious attachment risk reduction: attachment controls, user reporting workflows, and execution policy review for high-risk file types.
  • Harden and monitor Windows persistence surfaces, especially Task Scheduler, with least privilege and change visibility.
  • Maintain endpoint controls capable of detecting or blocking suspicious RAT behaviors such as unauthorized screen/video capture, keylogging, hidden execution, and tool transfer.
  • Strengthen DNS, proxy, and egress governance so unusual outbound C2 patterns can be investigated and contained quickly.
  • Protect credentials and interactive sessions with least privilege and rapid response procedures, since keylogging is a mapped behavior.
Additional notes and limits

This take is based only on the supplied ATT&CK S1087 object, its external references, and relationships. AsyncRAT is listed as a Windows tool with no official ATT&CK detection guidance and no object-level tactics specified. The defensive direction therefore comes from the related ATT&CK techniques and reported campaign/group relationships, not from a guaranteed detection recipe.

The supplied object does not include indicators, command examples, malware configuration details, hashes, network infrastructure, or official detection analytics. Technique relationships include some platforms beyond Windows, but the AsyncRAT object itself is Windows, so platform assumptions should remain Windows-focused unless local evidence shows otherwise.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

AsyncRAT

AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

20 rows
DomainIDNameRelationship / procedure
EnterpriseT1622Debugger Evasion

AsyncRAT can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.[3]

EnterpriseT1059.003Windows Command ShellSub-technique

AsyncRAT can be deployed via batch script.[4]

EnterpriseT1106Native API

AsyncRAT has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.[3]

EnterpriseT1124System Time Discovery

AsyncRAT can check whether the current system hour and day of the week are within operating hours defined it its configuration.[4]

EnterpriseT1568.002Domain Generation AlgorithmsSub-technique

AsyncRAT use a DGA to generate a C2 domains.[4]

EnterpriseT1090.003Multi-hop ProxySub-technique

AsyncRAT can proxy C2 through a Tor client.[4]

EnterpriseT1680Local Storage Discovery

AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`[3]

EnterpriseT1033System Owner/User Discovery

AsyncRAT can check if the current user of a compromised system is an administrator. [3]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

AsyncRAT has been delivered via malicious email attachments.[5]

EnterpriseT1568Dynamic Resolution

AsyncRAT can be configured to use dynamic DNS.[6]

EnterpriseT1564.003Hidden WindowSub-technique

AsyncRAT can hide the execution of scheduled tasks using `ProcessWindowStyle.Hidden`.[3]

EnterpriseT1497.001System ChecksSub-technique

AsyncRAT can identify strings such as Virtual, vmware, or VirtualBox to detect virtualized environments.[3]

EnterpriseT1125Video Capture

AsyncRAT can record screen content on targeted systems.[6]

EnterpriseT1105Ingress Tool Transfer

AsyncRAT has the ability to download files including over SFTP.[6][4]

EnterpriseT1204.002Malicious FileSub-technique

AsyncRAT has been executed through victims opening malicious file attachments.[5]

EnterpriseT1057Process Discovery

AsyncRAT can examine running processes to determine if a debugger is present.[3]

EnterpriseT1016System Network Configuration Discovery

AsyncRAT can enumerate the NetBIOS name on targeted machines.[4]

EnterpriseT1113Screen Capture

AsyncRAT has the ability to view the screen on compromised hosts.[6]

EnterpriseT1056.001KeyloggingSub-technique

AsyncRAT can capture keystrokes on the victim’s machine.[6]

EnterpriseT1053.005Scheduled TaskSub-technique

AsyncRAT can create a scheduled task to maintain persistence on system start-up.[3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1018: TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

GroupEnterprise

G0099: APT-C-36

APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1622: Debugger EvasionEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1568.002: Domain Generation AlgorithmsEnterpriseuses · TechniqueT1090.003: Multi-hop ProxyEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · CampaignC0060: Operation AkaiRyūEnterpriseuses · TechniqueT1568: Dynamic ResolutionEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1125: Video CaptureEnterpriseuses · GroupG1018: TA2541Enterpriseuses · GroupG0099: APT-C-36Enterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
3df7c39cce7989f6...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle3df7c39cce79…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  2. [2]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  3. [3]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  4. [4]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  5. [5]
    Recorded Future TAG-144 AUG 2025

    Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.

    Open source URL
  6. [6]
    AsyncRAT GitHub

    Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.

    Open source URL
  7. [7]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  8. [8]
    Kaspersky BlindEagle AUG 2024

    Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.

    Open source URL
  9. [9]
    Check Point Blind Eagle MAR 2025

    Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.

    Open source URL
  10. [10]
    LevelBlue Blind Eagle Proton66 JUN 2025

    Melnyk, S. (2025, June 27). Tracing Blind Eagle to Proton66. Retrieved April 16, 2026.

    Open source URL
  11. [11]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  12. [12]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  13. [13]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  14. [14]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  15. [15]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  16. [16]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  17. [17]
    mitre-attackS1087
    Open source URL
  18. [18]
    mitre-attackS1087
    Open source URL
  19. [19]
    mitre-attackS1087
    Open source URL
  20. [20]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  21. [21]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  22. [22]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  23. [23]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  24. [24]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  25. [25]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  26. [26]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  27. [27]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  28. [28]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  29. [29]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  30. [30]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  31. [31]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  32. [32]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  33. [33]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  34. [34]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  35. [35]
    Recorded Future TAG-144 AUG 2025

    Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.

    Open source URL
  36. [36]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  37. [37]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  38. [38]
    AsyncRAT GitHub

    Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.

    Open source URL
  39. [39]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  40. [40]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  41. [41]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  42. [42]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  43. [43]
    AsyncRAT GitHub

    Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.

    Open source URL
  44. [44]
    AsyncRAT GitHub

    Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.

    Open source URL
  45. [45]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  46. [46]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  47. [47]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  48. [48]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  49. [49]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  50. [50]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  51. [51]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  52. [52]
    Check Point Blind Eagle MAR 2025

    Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.

    Open source URL
  53. [53]
    Kaspersky BlindEagle AUG 2024

    Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.

    Open source URL
  54. [54]
    LevelBlue Blind Eagle Proton66 JUN 2025

    Melnyk, S. (2025, June 27). Tracing Blind Eagle to Proton66. Retrieved April 16, 2026.

    Open source URL
  55. [55]
    Recorded Future TAG-144 AUG 2025

    Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.

    Open source URL
  56. [56]
    Recorded Future TAG-144 AUG 2025

    Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.

    Open source URL
  57. [57]
    AsyncRAT GitHub

    Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.

    Open source URL
  58. [58]
    AsyncRAT GitHub

    Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.

    Open source URL
  59. [59]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  60. [60]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  61. [61]
    Recorded Future TAG-144 AUG 2025

    Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.

    Open source URL
  62. [62]
    Recorded Future TAG-144 AUG 2025

    Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.

    Open source URL
  63. [63]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  64. [64]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  65. [65]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  66. [66]
    AsyncRAT GitHub

    Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.

    Open source URL
  67. [67]
    AsyncRAT GitHub

    Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.

    Open source URL
  68. [68]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use