AsyncRAT & Remcos RATs + BabaDeda Loader: Multi-Stage Phishing & ClickFix Campaigns — Enterprise Detection Pack

Recent intelligence from the AlienVault OTX community highlights two active and sophisticated malware distribution campaigns currently targeting global enterprises. These campaigns employ distinct yet equally dangerous infection chains designed to bypass traditional email gateway defenses and endpoint security.

The first campaign utilizes a multi-stage phishing attack that relies on social engineering to lure victims into enabling macros in malicious Excel attachments. Once enabled, a complex execution chain involving HTA scripts, PowerShell, and steganography—hiding payloads within PNG image files—is triggered. This "fileless" approach ultimately delivers Remote Access Trojans (RATs), specifically AsyncRAT and Remcos, granting attackers full remote control over infected systems.

The second campaign leverages the BabaDeda Loader, a stealthy malware family that has undergone significant evolution in 2026. Its primary vector is a social engineering technique known as ClickFix, which deceives users into initiating a malicious installation process. This loader is designed to conceal malicious payloads within legitimate-looking software installers, making it exceptionally difficult to detect during the initial compromise phase.

Collectively, these threats underscore a shift toward highly obfuscated, multi-layered attack chains that prioritize evasion and stealth. The ultimate objective for the threat actors behind these campaigns is the establishment of persistent remote access for data theft, espionage, or lateral movement within victim networks.

Threat Actor / Malware Profile

AsyncRAT & Remcos

• Distribution Method: Phishing emails with malicious Excel (XLS) attachments containing macros. The macros download and execute an HTA file, which in turn runs a PowerShell script to decode and fetch the final payload. Steganography is used to hide the payload within a PNG file.
• Payload Behavior: These are Remote Access Trojans (RATs) designed to provide attackers with complete remote control over an infected host. Key capabilities include:
  • Remote command execution (cmd, PowerShell)
  • Screen capturing and webcam access
  • Keystroke logging
  • File system manipulation (download, upload, delete)
  • Credential harvesting from browsers and system stores
• C2 Communication: Both RATs communicate with their Command & Control (C2) servers over HTTP/HTTPS, often using custom or standard encoding to blend in with normal web traffic. The IOCs indicate C2 infrastructure on non-standard ports (e.g., 4550, 14641).
• Persistence Mechanism: Typically established via:
  • Scheduled tasks that execute the malware on a recurring basis or at user logon.
  • Registry run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run).
  • LNK file manipulation in the Windows Startup folder.
• Anti-Analysis Techniques: The campaign employs heavy obfuscation at every stage, from macro code to PowerShell commands and the final payload. The use of steganography is a notable anti-analysis technique, as static analysis of the image file will not reveal the malicious code. The malware may also include anti-debugging and anti-virtualization checks.

BabaDeda Loader

• Distribution Method: Social engineering via the "ClickFix" technique. This often involves deceptive web pop-ups or fake error messages that trick users into copying and pasting a malicious command into a terminal (e.g., PowerShell or Bash), or clicking a button that initiates a malicious download. The final payload is hidden within a legitimate-looking installer package.
• Payload Behavior: BabaDeda is a sophisticated loader whose primary function is to download and execute a second-stage payload, which could be any malware (e.g., stealers, ransomware, other RATs). Its key features are stealth and payload flexibility.
• C2 Communication: The loader communicates with its C2 server to download payloads and receive configuration. IOCs suggest the use of HTTP with specific query parameters (e.g., q= for an MD5 hash) to request payloads.
• Persistence Mechanism: As a loader, its primary role is initial access. Persistence is typically a function of the payload it delivers. However, it may create temporary files or scheduled tasks to ensure payload delivery.
• Anti-Analysis Techniques: The framework is designed for stealth, concealing its malicious components within benign-looking installers. This makes signature-based detection difficult. It likely employs packing, encryption, or other code obfuscation methods to hinder dynamic analysis.

IOC Analysis

The provided indicators of compromise (IOCs) are critical for threat hunting and incident response.

• IP Addresses & Domains: (e.g., 192.227.219.79, 107.172.235.213, cirealci.com) These represent the C2 infrastructure. Security teams must immediately block these at the network perimeter (firewalls, proxies, secure web gateways) and on internal DNS resolvers. Their presence in network logs is a strong indicator of successful compromise or C2 beaconing.
• URLs: (e.g., http://107.172.135.60/96/ibredgoodforbestthingscomingbackform.hta, http://95.163.152.190/linguist.zip) These are the payload delivery URLs. Blocking these prevents the malware from being downloaded after the initial phishing lure is successful. Analyzing the URL paths can provide insight into the campaign's naming conventions and infrastructure.
• File Hashes (SHA256, SHA1, MD5): (e.g., 614115669d093c58539e8183617a62a59aefd1a9a1fddcc7a67508f2fb9e36ab, b2e581c85432bd4df6a59a00cbda1cb3) These are fingerprints of malicious files, including the Excel dropper, HTA scripts, and the RAT/loader payloads. SOC teams should use these hashes to:
  • Hunt for the presence of these files on endpoints (EDR, antivirus).
  • Correlate with historical security events.
  • Block files by hash at the email gateway and web proxy.

Operationalization: The most effective way to operationalize these IOCs is through an integration with a Threat Intelligence Platform (TIP) or directly into your SIEM and EDR solutions. This allows for automated correlation, alerting, and blocking based on these observed artifacts. Hunt queries should focus on network connections to the listed IPs/domains and the execution of processes matching the provided file hashes.

Detection Engineering

Sigma Rules

The following Sigma rules are designed to detect the specific behaviors observed in these campaigns, including macro-enabled documents, suspicious PowerShell execution, and network connections to the identified C2 infrastructure.

---
title: Potential AsyncRAT/Remcos Phishing Macro Execution
description: Detects the execution of a suspicious process chain often associated with AsyncRAT and Remcos delivery via macro-enabled documents. This includes spawning `mshta.exe` or `powershell.exe` from a Microsoft Office process.
author: Security Arsenal
date: 2026/07/27
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1566.001
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  filter:
    CommandLine|contains:
      - 'vbscript'
      - 'CreateObject'
      - 'Invoke-Expression'
      - 'DownloadString'
  condition: selection and filter
falsepositives:
  - Legitimate administrative scripts launched from Office documents (rare)
level: high
---
title: Suspicious PowerShell Command with Encoded Content
id: 55f4b9b4-2621-4f5f-919e-5a1e3a6e7d1d
description: Detects PowerShell commands with heavily encoded or obfuscated content, a common technique in the AsyncRAT/Remcos campaign to hide the payload download URL.
author: Security Arsenal
date: 2026/07/27
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1027
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
    CommandLine|contains:
      - ' -enc '
      - ' -encodedcommand '
      - ' -e '
  selection_obfuscation:
    CommandLine|contains:
      - 'FromBase64String'
      - 'ToBase64String'
      - 'Char'
      - 'Join'
  condition: selection_powershell and selection_obfuscation
falsepositives:
  - Legitimate administrative scripts that use encoding (should be validated)
level: medium
---
title: Network Connection to AsyncRAT/BabaDeda C2 Infrastructure
id: 2385472f-4748-431f-92a6-67c3b92f8a65
description: Detects network connections to known C2 IP addresses and ports associated with the active AsyncRAT and BabaDeda campaigns.
author: Security Arsenal
date: 2026/07/27
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_ips:
    DestinationIp|startswith:
      - '192.227.219.'
      - '107.172.'
      - '173.231.188.'
      - '91.92.'
      - '89.124.'
      - '94.26.'
      - '95.163.'
  selection_ports:
    DestinationPort:
      - 4550
      - 14641
      - 3038
      - 9000
      - 6600
  condition: 1 of selection_*
falsepositives:
  - Legitimate connections to IP ranges that may be shared with other services (unlikely for non-standard ports)
level: critical

KQL Hunt Queries (Microsoft Sentinel)

These KQL queries can be used in Microsoft Sentinel to hunt for related activity across network and process event logs.

// Hunt for network connections to C2 infrastructure from AsyncRAT/BabaDeda pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("192.227.219.79", "107.172.235.213", "173.231.188.244", "91.92.243.161", "89.124.81.216", "94.26.83.190", "95.163.152.190")
    or RemotePort in (4550, 14641, 3038, 9000, 6600)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl


kql
// Hunt for process execution patterns from AsyncRAT/Remcos phishing campaign
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FolderPath endswith @"\winword.exe" or FolderPath endswith @"\excel.exe") and InitiatingProcessCommandLine contains @".exe"
| where ProcessCommandLine has "mshta" or ProcessCommandLine has "powershell" or ProcessCommandLine has "cmd.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256, MD5

PowerShell IOC Hunt Script

This script can be run on endpoints to check for specific registry keys, file paths, and network connections associated with the AsyncRAT and Remcos campaigns.

# AsyncRAT/Remcos IOC Hunt Script
# Run as Administrator

Write-Host "Checking for AsyncRAT/Remcos Persistence and Activity..." -ForegroundColor Cyan

# 1. Check for scheduled tasks created with common AsyncRAT/Remcos naming conventions
$suspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -match "powershell|cmd|mshta" -and 
    ($_.Actions.Arguments -match "http" -or $_.Actions.Arguments -match "-enc")
}
if ($suspiciousTasks) {
    Write-Host "[!] Found suspicious scheduled tasks:" -ForegroundColor Red
    $suspiciousTasks | Format-List TaskName, State, Actions
} else {
    Write-Host "[-] No suspicious scheduled tasks found." -ForegroundColor Green
}

# 2. Check for suspicious run keys
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
$suspiciousRunKeys = @()
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-Item $key | ForEach-Object { 
            $_.Property | ForEach-Object { 
                $value = (Get-ItemProperty -Path "$key" -Name $_).$_
                if ($value -match "http" -or $value -match "-enc") {
                    $suspiciousRunKeys += [PSCustomObject]@{Key=$key; Name=$_; Value=$value}
                }
            }
        }
    }
}
if ($suspiciousRunKeys) {
    Write-Host "[!] Found suspicious run keys:" -ForegroundColor Red
    $suspiciousRunKeys | Format-Table -AutoSize
} else {
    Write-Host "[-] No suspicious run keys found." -ForegroundColor Green
}

# 3. Check for active network connections to known C2 IPs
$c2IPs = @("192.227.219.79", "107.172.235.213", "173.231.188.244")
$activeConnections = Get-NetTCPConnection | Where-Object { 
    $c2IPs -contains $_.RemoteAddress 
}
if ($activeConnections) {
    Write-Host "[!] Found active connections to known C2 IPs:" -ForegroundColor Red
    $activeConnections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State -AutoSize
    $activeProcesses = $activeConnections | ForEach-Object { Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue }
    Write-Host "Owning processes for these connections:"
    $activeProcesses | Format-Table Id, ProcessName, Path -AutoSize
} else {
    Write-Host "[-] No active connections to known C2 IPs found." -ForegroundColor Green
}

Write-Host "Hunt complete. Review any findings." -ForegroundColor Cyan

Response Priorities

Immediate Actions (Next 4 Hours):

1. Block IOCs: Immediately block all listed IP addresses, domains, and URLs at network perimeter devices (firewalls, proxies) and within endpoint protection platforms (EPP/EDR).
2. Hunt for Compromise: Execute the provided PowerShell script and KQL queries across the enterprise to identify any hosts that have already communicated with the C2 infrastructure or show signs of the described infection chains.
3. Isolate Infected Hosts: Isolate any endpoints confirmed to be compromised to prevent lateral movement and further data exfiltration.
4. Alert SOC Team: Inform the SOC of the active threats to increase vigilance and facilitate rapid response to any new alerts.

24-Hour Actions:

1. Malware Analysis: If available, detonate samples associated with the provided file hashes in a sandbox environment to fully understand the payload's capabilities and identify any additional, unlisted IOCs.
2. User Awareness: Issue a security advisory to all employees highlighting the dangers of enabling macros and the deceptive tactics used in ClickFix and phishing attacks.
3. Credential Reset: If credential theft is suspected (a common capability of AsyncRAT/Remcos), initiate a forced password reset for users on compromised hosts and for any privileged accounts.

1-Week Actions:

1. Macro Hardening: Enforce or verify group policy settings that disable macros from the internet and require digitally signed macros.
2. Attack Surface Reduction: Implement Microsoft Defender Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from downloading executable content.
3. Email Security: Review and enhance email gateway configurations to better detect and block phishing emails with malicious attachments and to flag suspicious URLs.
4. Threat Intelligence Integration: Integrate OTX or a similar feed into your SIEM and TIP to automate the ingestion and operationalization of future IOCs.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub