Threat Spotlight: AsyncRAT campaigns feature new version of 3LOSH crypter
Summary: Cisco Talos reports a series of campaigns over the past several months using a new version of the 3LOSH crypter to obfuscate the initial infection code, with new samples uploaded to public repositories daily. The infection begins with an ISO containing a malicious VBScript that pulls a PowerShell stage from an attacker-controlled server, creates a working directory at C:\ProgramData\Facebook\System32\Microsoft\SystemData, establishes a scheduled task named "Office" that repeats every two minutes, and injects a final payload via aspnet_compiler.exe - most often AsyncRAT or LimeRAT, with one AsyncRAT config carrying the Group_ID "3LOSH".
Bottom line: The same operator appears to be distributing multiple commodity RATs from shared post-compromise C2 infrastructure, so blocking one payload family does not close the campaign - Talos advises detecting 3LOSH activity independent of the final payload.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026