AsyncRAT
Software · ATTACK:enterprise:S1087
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1087",
"title": "AsyncRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1087",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--6a5947f3-1a36-4653-8734-526df3e1d28d",
"external_id": "S1087",
"domain": "enterprise",
"created": "2023-09-20T17:32:59.932Z",
"modified": "2026-05-12T15:12:00.740Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Telefonica Snip3 December 2021",
"url": "https://telefonicatech.com/blog/snip3-investigacion-malware"
},
{
"source_name": "Morphisec Snip3 May 2021",
"url": "https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"
},
{
"source_name": "Cisco Operation Layover September 2021",
"url": "https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0324f691-2708-4272-86a5-e0cb40aeba9e
Telefonica Snip3 December 2021ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b86182d-8435-4632-92fe-a2a8ac720b77
ESET MirrorFace 2025ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10435dca-baee-420a-a2b3-b13209e2d96a
Telefonica Snip3 December 2021ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18787e29-05a1-49c5-9b8b-0376ba020bd7
ESET MirrorFace 2025ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1568.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f8a573c-f602-4b81-a4b5-adf6bdbaeda3
ESET MirrorFace 2025ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4318a3e0-de45-4d78-a205-527e08c51fe8
ESET MirrorFace 2025ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43ab17df-742f-4bc5-815a-7da2feed73f0
Telefonica Snip3 December 2021ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57851829-665d-4871-9327-1734547f7d9d
Telefonica Snip3 December 2021ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61853db1-63fa-464a-8ac0-a2e6996850e1
Recorded Future TAG-144 AUG 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61b69adb-6adb-48e5-890a-c954af2e3170
ESET MirrorFace 2025ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a56f549-3835-4f1f-8ece-fb8400f04432
AsyncRAT GitHubATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--783f71a1-8a2b-4dbe-9011-a24042f36c88
Telefonica Snip3 December 2021ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c290539-09a9-4ff2-956a-d5026dba86a5
Telefonica Snip3 December 2021ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84094d38-2a22-4d9a-b570-72e45baf17ab
AsyncRAT GitHubATTACK:enterprise:G1018 → uses → ATTACK:enterprise:S1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc99bfb1-8529-4116-b702-07c37d333bcf
Telefonica Snip3 December 2021 · Proofpoint TA2541 February 2022 · Morphisec Snip3 May 2021 · Cisco Operation Layover September 2021ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd8f6713-f3f2-4caf-b775-18e1062ce8bb
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca31e6ec-8cf9-4e5e-907a-895c3d19543f
ESET MirrorFace 2025 · AsyncRAT GitHubATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd589f82-0783-40d9-8dc9-1e561413a395
Recorded Future TAG-144 AUG 2025ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d531b421-7347-4dd6-9a98-0b05e6421b40
Telefonica Snip3 December 2021ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e463dac2-01d3-4894-84b5-22064400862a
ESET MirrorFace 2025ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed592480-2e4d-4604-aa8d-89bf58d72f6b
AsyncRAT GitHubATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8999244-37ea-40f1-aa90-444a676dd592
AsyncRAT GitHubATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9c7cede-2f07-4a54-9dcd-14304055886a
Telefonica Snip3 December 2021