{"id":26149,"date":"2026-09-21T13:06:38","date_gmt":"2026-09-21T21:06:38","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/threat-actors-weaponize-ai-hype-to-deliver-asyncrat-3\/"},"modified":"2026-09-21T13:06:38","modified_gmt":"2026-09-21T21:06:38","slug":"threat-actors-weaponize-ai-hype-to-deliver-asyncrat-3","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/threat-actors-weaponize-ai-hype-to-deliver-asyncrat-3\/","title":{"rendered":"Threat Actors Weaponize AI Hype to Deliver AsyncRAT"},"content":{"rendered":"<div class=\"Table-Content aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"blog-toc\">\n<div class=\"b3-blog-list__row\">\n<div class=\"b3-blog-list__column-left table-content-wrapper automatic\">\n<ul class=\"table-of-content\">\n<li class=\"header\"><img decoding=\"async\" alt=\"\" class=\"toc-icon\" src=\"\/content\/dam\/fortinet\/images\/toc-icon.jpg\"\/>Article Contents<\/li>\n<\/ul>\n<\/div>\n<div class=\"aem-GridColumn aem-GridColumn--default--8 b3-blog-list__column-right scrolling-content automatic\">\n<div class=\"b15-blog-meta__container text-container\">\n<span>By <\/span><br \/>\n<span class=\"b15-blog-meta__author\"><br \/>\n<a href=\"\/blog\/search?author=Cara+Lin\">Cara Lin<\/a><br \/>\n<\/span><br \/>\n<span class=\"b15-blog-meta__\"><br \/>\n<\/span><br \/>\n<span class=\"b15-blog-meta__date\"> | June 11, 2026<\/span>\n<\/div>\n<div class=\"raw-import\">\n<div class=\"text-container\"><\/div>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p style=\"\tmargin-left: 80.0px;\n\"><b>Affected Platforms: <\/b>Microsoft Windows<br \/>\n<b>Impacted Users: <\/b>Any organization<br \/>\n<b>Impact: <\/b>Attackers gain control of the infected systems<br \/>\n<b>Severity Level: <\/b>High<\/p>\n<p>As AI adoption continues to grow, threat actors have wasted no time exploiting the trend. FortiGuard Labs recently observed a campaign delivering malicious files disguised as AI-related documents, with titles such as &#8220;AI-Ready PostgreSQL 18: Building Intelligent Data Systems&#8221; and &#8221; A Guide for Thinking Marketers in the Age of AI.&#8221;<\/p>\n<p>These lures are designed to target users actively seeking AI-related learning resources. The attack chain behind these files is remarkably complex, using multiple staged scripts to hide activity before ultimately deploying AutoHotkey-based loaders that reflectively inject a .NET remote access trojan and AsynRAT into memory for command-and-control communication and follow-on execution. Notably, several intermediate-stage scripts make heavy use of Simplified Chinese variable names and exhibit a highly structured coding style, suggesting the threat actor likely leveraged AI assistance during development. This article walks through each stage of the infection chain in detail.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 1: Attack chain<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>The Initial ZIP with LNK<\/h2>\n<p>The malware was distributed inside a compressed archive disguised as a technical resource titled <b>Agentic Coding with Claude Code, The everyday developer\u2019s guide to agentic coding with Claude Code.7z<\/b>. At first glance, the archive appears harmless. Its visible contents are limited to a shortcut file, but it actually contains two other files named <b>3th.pdf<\/b> and <b>4th.pdf<\/b> with a Hidden attribute. The archive was intentionally designed to appear harmless. The archive does not distribute a straightforward executable. Instead, it delivers a carefully staged intrusion chain in which each phase exists primarily to reveal the next.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 2: LNK and hidden files in the archived file<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>Once the victim opens the LNK file, the shortcut executes an obfuscated command sequence built from native Windows components such as <b>cmd.exe<\/b>, <b>more<\/b>, <b>type<\/b>, and <b>findstr<\/b>. The LNK treats <b>3th.pdf<\/b> not as a document, but as a data container. It enumerates the file line by line, extracts a narrow range of lines (26004, 26005, 26006, and 26007), and executes only that extracted content. The attacker doesn\u2019t place their payload in a single obvious script or executable. Instead, they use a single file as a multi-zone storage container, with each phase knowing only how to retrieve the next phase at a specific offset.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 3: Command in LNK file<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>The Embedded PowerShell Script<\/h2>\n<p>The first extracted block from <b>3th.pdf<\/b> is not the final payload either. It is a short staging script that again reads from <b>3th.pdf<\/b>, but this time skipping deep into the file and selecting another limited line range before piping the result directly into PowerShell. The PowerShell stage is invoked with \u201c-windowstyle hidden\u201d to suppress any visible console window, -NoProfile (-nop) to prevent interference from user profile scripts, and -ExecutionPolicy Bypass (-ep Bypass) to circumvent the system&#8217;s script execution restrictions.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 4: Targeted batch script in 3.pdf<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The PowerShell script contains cryptographic logic. It searches <b>3th.pdf <\/b>for data wrapped between markers m1 and m2 <b>(&#8212;&#8211;BEGIN PGP PRIVATE KEY BLOCK&#8212;&#8211;<\/b> and <b>&#8212;&#8211;END PGP PRIVATE KEY BLOCK&#8212;&#8211;<\/b>), filters out header-like lines, concatenates the remaining content, and decodes it from Base64. The script uses a fixed password of &#8220;1&#8221; and derives keys through PBKDF2 before decrypting the payload with AES-CBC. The plaintext is interpreted as a PowerShell script saved at %APPDATA% as <b>Cache_{GUID}.ps1<\/b> and immediately executed.\n<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 5:Extracting data from 3.pdf<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 6: The encrypted data in 3.pdf<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 7: Dropping decrypted data as Cache_{GUID}.ps1<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>The Dropped PowerShell Script<\/h2>\n<p>Once the decrypted script runs, the role of<b> 3th.pdf<\/b> expands further. The file contains not just one hidden stage but several distinct embedded data regions. The script first builds a working directory under\u00a0<b style=\"\">%LOCALAPPDATA%\\Packages\\Microsoft.WindowsSoundDiagnostics<\/b>, a path clearly chosen to resemble a benign Windows audio or diagnostics component. It then searches <b style=\"\">3th.pdf<\/b> for <b style=\"\">=== SoundEffects X ===<\/b> markers, concatenates the hex data between them, strips out non-hex characters, converts the result back into bytes, and writes the output as a file named <b style=\"\">Subtitles.<\/b><\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 8: Extracting data from 3.pdf and saving it as &#8220;Subtitles\u201d<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The script then performs two additional extraction routines against <b>3th.pdf<\/b>, scanning for fields named <b>Name<\/b> and <b>KasKos<\/b>, decoding their Base64-encoded payloads using a custom XOR-based decryption routine keyed to the hardcoded string <b>Realtek2025<\/b>, and writing the results to the same staging directory as <b>RealtekAudioService64.ps1<\/b> and R<b>ealtekAudioService64.bat<\/b>.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 9: Extracting a PowerShell and batch script from 3.pdf<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>After the payload extraction, the script establishes persistence by registering a scheduled task named <b>CheckRealtekAudioVersion<\/b>, disguised as a Realtek audio service and configured to execute the dropped <b>RealtekAudioService64.bat<\/b> via cmd.exe. The task employs privilege-aware configuration and dual triggers to ensure the batch file is reliably invoked shortly after infection and at each subsequent user logon. Finally, it extracts the clean decoy <b>4th.pdf<\/b>, a clean, benign decoy document presented to the victim as a distraction, creating the illusion of a legitimate file opening while the malicious components continue to execute silently in the background.<\/p>\n<p>The coding style and inline annotations suggest the script was likely developed with assistance from a generative AI tool. The presence of a Simplified Chinese comment (# \u9759\u9ed8\u4efb\u52a1\u521b\u5efa\u811a\u672c &#8211; \u65e0\u8f93\u51fa\u7248\u672c) alongside an emoji-annotated line (# \ud83d\udd25 REMOVE EVERYTHING NOT HEX) within an otherwise English language script indicates that the threat actor&#8217;s native language inadvertently surfaced in AI-generated output that was not fully sanitized before deployment. This is consistent with a workflow in which the overall attack logic was designed by a human operator, with AI tooling used to accelerate code implementation.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 10: Persistence setting<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 11: Decoy PDF<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>Dropped Scripts \u201cRealtekAudioService64\u201d<\/h2>\n<p><b>RealtekAudioService64.bat<\/b> serves as a stealthy launcher for the PowerShell stage. It first checks whether it was invoked with the hidden argument. If not, it immediately relaunches via PowerShell with -WindowStyle Hidden to suppress any visible console window before exiting the original instance. Once running in a hidden state, the string powershell.exe is reconstructed by concatenating three split variables rather than being referenced directly, a simple but effective technique to evade string-based static detection. The script then creates a timestamped log file in the staging directory with a versioned name (ver0x0000000000000003_) designed to blend in as a legitimate diagnostic artifact, before invoking <b>RealtekAudioService64.ps1<\/b> with the -NoProfile, -WindowStyle Hidden, and -ExecutionPolicy Bypass flags to ensure silent and unrestricted execution. Finally, the log file is deleted to remove any trace of execution, leaving minimal forensic evidence.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 12: Executing a PowerShell script in a batch file<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p><b>RealtekAudioService64.ps1<\/b> represents a more sophisticated stage of the infection chain, employing multiple layers of obfuscation throughout its execution. Most notably, all PowerShell built-in cmdlets such as Test-Path, Join-Path, New-Item, and Out-Null are reconstructed at runtime from character arrays and stored entirely under Simplified Chinese variable names, i.e., $\u6d4b\u8bd5\u8def\u5f84, $\u8fde\u63a5\u8def\u5f84, $\u65b0\u5efa\u9879\u76ee, and $\u8f93\u51fa\u7a7a\u503c.<\/p>\n<p>This deliberate use of Chinese-language identifiers serves a dual purpose: it renders the script largely unreadable to analysts unfamiliar with the obfuscation pattern, and it bypasses signature-based detection rules that rely on recognizable English cmdlet strings. Directory paths and binary filenames are further concealed as Base64-encoded strings, which are decoded at runtime, ensuring that sensitive indicators do not appear in plaintext in the script body.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 13: Defining variables in the PowerShell script<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>It opens the previously dropped <b>Subtitles<\/b> file as a GZip-compressed stream and decompresses it using a custom record structure. Each entry includes a relative path, a type field indicating whether it is a file or directory, and for file entries, a length followed by raw data. Before writing each file to disk, <b>RealtekAudioService64.ps1<\/b> applies a byte transformation equivalent to subtracting 3 modulo 256, which serves as a lightweight decryption layer. The recovered directory tree is written to the path<b> %LOCALAPPDATA%\\Packages\\Microsoft.WindowsSoundDiagnostics<\/b>, where it deposits the real components that drive later execution stages, including AutoHotkey-based loaders, AHK scripts, and batch files.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 14: Decoding and extracting &#8221; Subtitles\u201d<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>After extraction, it registers two scheduled tasks: one targeting <b>RealtekAudioEnhancements64.exe<\/b> in the <b>ConfigureSoundSettings<\/b> subdirectory, and another targeting <b>RtkNGUI64.exe<\/b> in the <b>Cache<\/b> directory, registered under the task names <b>RealtekAudioEnhancements64<\/b> and <b>CheckRealtekAudioVersion,<\/b> respectively. Both tasks are configured with multiple triggers covering user logon, system startup, and, where privileges permit, a daily trigger firing at noon, establishing robust and redundant persistence across reboots and user sessions.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 15: Raw data of decoded &#8220;Subtitles&#8221;<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 16: Persistence setting<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>AutoHotkey Loader<\/h2>\n<p>One of the most important findings at this stage is that two of the recovered executables are not custom malware binaries. Their hashes match AutoHotkey.exe, even though they are named to resemble Realtek-related audio components. This indicates that the attackers are abusing AutoHotkey as an execution engine. The visible executable is benign, and the malicious logic resides in *.ahk scripts. This is an effective design choice. It reduces the need to deliver many custom compiled executables and shifts more logic into script layers that are easier to mutate and harder to classify based solely on PE characteristics.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n-->\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n-->\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 17: The extracted data from &#8220;Subtitles&#8221;<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>From here, the chain splits into two major branches. The more substantial branch is driven by <b>RtkNGUI64.ahk<\/b>. That script imports four additional modules and then calls routines that reveal its true purpose. One helper selects a legitimate .NET Framework executable from <b>C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\<\/b>, choosing randomly among binaries such as <b>AddInProcess32.exe<\/b>, <b>AppLaunch.exe<\/b>, and <b>aspnet_compiler.exe<\/b>. Another helper reads the file <b>RtkLoggingManifest.man<\/b> line by line, extracting integers from strings of the form <b>System metric code = &lt;number&gt;<\/b> and converting them into a byte array. In other words, the so-called manifest file is actually a disguised PE payload encoded as numeric text. After a brief delay, the script passes those bytes and the chosen host process path to an<b> Execute()<\/b> function implemented in <b>RtkDiagService.ahk<\/b>.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 18: RtkNGUI64.ahk for path definition and the loading of four additional modules<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 19: RtkDeviceConfigure64.ahk for file reading<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 20: RtkCplApp.ahk for choosing targeted executables<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>That <b>Execute() <\/b>implements a full process hollowing workflow. The script creates a legitimate .NET process in a suspended state, parses the PE structure of the reconstructed payload, retrieves the target thread context, optionally unmaps the original image, allocates memory within the remote process, writes the payload\u2019s headers and sections to the new memory region, repairs the execution context, and finally resumes the suspended thread.<\/p>\n<p>The underlying API calls follow a classic injection sequence that includes <b>CreateProcess<\/b>, <b>GetThreadContext<\/b>, <b>WriteProcessMemory<\/b>, <b>VirtualAllocEx<\/b>, <b>ZwUnmapViewOfSection<\/b>, <b>SetThreadContext<\/b>, and <b>ResumeThread<\/b>. Rather than launching the payload directly from disk, this branch reconstructs a hidden PE from text-based data and injects it into a legitimate .NET Framework process.<\/p>\n<p>What makes this implementation particularly unusual is its extensive use of identifiers drawn from Chinese mythology and philosophy throughout the script. Rather than directly referencing Windows APIs, the malware maps them to symbolic aliases such as \u201c\u4e5d\u5929\u7384\u5973\u201c (CreateProcess), \u201c\u4e7e\u5764\u888b\u201c (VirtualAllocEx), and \u201c\u8d77\u6b7b\u56de\u751f\u201c (ResumeThread). Additional layers of abstraction are introduced through grouped naming schemes based on concepts such as \u201c\u4e09\u754c\u516d\u9053\u201c (Three Realms and Six Paths) and \u201c\u4e94\u884c\u516b\u5366\u201c (Five Elements and Eight Trigrams).<\/p>\n<p>\nThese identifiers serve little functional purpose beyond obscuring the actual execution flow and complicating manual analysis. The naming style is highly unconventional for malware development and differs significantly from the short English variable names commonly seen in commodity loaders. Combined with the repetitive structural patterns and heavily templated code style observed across the scripts, the implementation strongly suggests the actor intentionally used culturally themed semantic abstraction to reduce readability and potentially evade simplistic pattern-based detection or analyst triage.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 21: RtkDiagService.ahk for injection<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The content derived from <b>RtkLoggingManifest.man<\/b> is a .NET executable. Although it has been obfuscated, we can still tell it is a <b>clay_Client <\/b>with RAT capabilities. We will discuss it in a later section.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 22: RtkLoggingManifest.man containing the decoded data<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 23: Decoded executable from RtkLoggingManifest.man<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The second branch, centered on<b> RealtekAudioEnhancements64.ahk<\/b>, is initially simpler but ultimately proves equally revealing. This script primarily serves as a wrapper that silently launches <b>RealtekAudioEnhancements64.bat<\/b>. The batch file then repeats the architectural theme seen earlier: it does not directly contain the next PowerShell payload, but instead reads another disguised container named <b>RealtekAudioEnhancements64.assets<\/b>, skips a fixed number of lines, extracts a narrow segment, and pipes that segment into PowerShell. The <b>.assets<\/b> file therefore functions as yet another stage container, with a malicious script buried within a much larger body of otherwise irrelevant or decoy content.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 24: RealtekAudioEnhancements64.ahk for running \u201cRealtekAudioEnhancements64.bat\u201d<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 25: RealtekAudioEnhancements64.bat for executing a script in .assets file<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The PowerShell recovered from <b>.assets<\/b> performs a different type of work. Before launching subsequent payloads, it attempts to weaken host defenses and normalize the environment for follow-on execution. It uses an elevated PowerShell process with <b>runas<\/b> to call <b>Add-MpPreference<\/b>, adding C:\\ to Microsoft Defender\u2019s exclusion paths and adding powershell.exe to Defender\u2019s excluded processes. This is an overt defense-evasion step. The same script then launches two additional PowerShell files: <b>RealtekAudioEnhancements64.ps1<\/b> and <b>RealtekAudioEnhancements32.ps1<\/b>.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 26: RealtekAudioEnhancements64.assets<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The 32-bit script is not a payload in the traditional sense. It serves as an environmental repair tool. It checks whether Windows Script Host has been disabled in the registry, re-enables it if necessary, and restores .vbs file associations to wscript.exe. If the required registry edits require elevated privileges, it relaunches itself with those privileges. This behavior is unusual but tactically significant. The malware is not merely hoping the system can execute VBS. It actively ensures that VBS execution is restored if the host has been hardened against it.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 27: RealtekAudioEnhancements32.ps1<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The 64-bit companion script uses the repaired scripting environment to establish an additional persistence layer. It writes a scheduled-task XML definition and a VBS file named <b>ResetRealtekAudioSettings64.vbs<\/b>, then creates a scheduled task called ResetRealtekAudioSettings64. That task does not call a PowerShell script directly. Instead, it invokes wscript.exe to run the VBS in background mode, and the VBS in turn launches another batch file with the following content:<\/p>\n<p style=\"\tmargin-left: 40.0px;\n\"><i>On Error Resume Next<\/i><\/p>\n<p style=\"\tmargin-left: 40.0px;\n\"><i>Set shell = CreateObject(&#8220;WScript.Shell&#8221;)<\/i><\/p>\n<p style=\"\tmargin-left: 40.0px;\n\"><i>localAppData = shell.ExpandEnvironmentStrings(&#8220;%LOCALAPPDATA%&#8221;)<\/i><\/p>\n<p style=\"\tmargin-left: 40.0px;\n\"><i>docPath = localAppData &amp; &#8220;\\Packages\\Microsoft.WindowsSoundDiagnostics\\Cache&#8221;<\/i><\/p>\n<p style=\"\tmargin-left: 40.0px;\n\"><i>shell.Run &#8220;&#8221;&#8221;&#8221; &amp; docPath &amp; &#8220;\\ResetRealtekAudioSettings64defualt.bat&#8221;&#8221;&#8221;, 0, False<\/i><\/p>\n<p>This shows the actor layering persistence to reduce reliance on any single launcher. By this point, the malware has already used Task Scheduler once, but it now adds a VBS-mediated task chain on top of the earlier mechanisms.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 28: Created XML file<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The next batch file again acts as a line-range extractor, this time using a file named <b>ResetRealtekAudioSettings64.Realtek<\/b> as its container. It skips roughly 1,000 lines, extracts a specific block, and passes it to PowerShell. The <b>.Realtek<\/b> file is therefore another disguised payload archive, like 3th.pdf and .assets before it. The PowerShell block pulled from this file contains two important embedded objects. One is a long hex-encoded PE starting with MZ, followed by a valid PE header and .NET-specific imports such as <b>mscoree.dll<\/b> and <b>_CorDllMain<\/b>, confirming that it represents a 32-bit .NET executable or DLL. The second is another .NET assembly that is loaded reflectively in memory using <b>Assembly.Load<\/b>. The script then uses reflection to locate a public static method in that loader assembly and supplies two critical inputs: the path to <b>C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe<\/b> and the reconstructed .NET payload bytes.<\/p>\n<p>At this point, PowerShell is no longer the primary executor. It is simply a mechanism for reflectively loading a .NET loader, which then prepares another .NET payload to run under a legitimate .NET utility. This aligns with the broader theme of operating within trusted execution surfaces and pushing malicious behavior deeper into memory-resident components.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n-->\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 29: ResetRealtekAudioSettings64.Realtek<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>Final Payload RAT<\/h2>\n<p>The final recovered .NET file from<b> ResetRealtekAudioSettings64.Realtek<\/b> is a modular RAT. It has been obfuscated and string encoded to increase the difficulty of analysis. It first creates mutex <b>IDG5FUAM3PSONBSInGIGSWSD <\/b>to prevent repeated execution.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 30: .NET executable<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>After sleeping for a while, it decodes the strings for the C2 list: shampobiskworld.nl, shampoolagtto.com, and shamppocosmaticso.com. Once it contacts its C2 server, it extracts basic information from victims and uploads it to a remote server, including win32_processor, Environment.UserName, SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion for the OS version and build number, Win32_Processor.deviceid for the CPU, the security appliance from query root\\SecurityCenter2, and the system time in the format yyyy-MM-dd HH:mm:ss.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 31: Sets up C2 connection<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The main class functions as the RAT\u2019s command handler. It receives encrypted instructions from the C2 server, decrypts and deserializes them into an object array, and then uses the command value to determine which capability to execute.<b><\/b><\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 32: Handling commands from the C2<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The command sets have the following categories:<\/p>\n<p style=\"\tmargin-left: 40.0px;\n\">1. <b>System Control Commands:<\/b> these instructions manage the implant&#8217;s state, persistence, and presence on the victim\u2019s machine.\n<\/p>\n<table border=\"1\" cellpadding=\"0\" cellspacing=\"0\" class=\"details-tbl\" style=\"\tmargin-left: 40.0px;\n\" width=\"95%\"><\/p>\n<tbody>\n<tr>\n<td width=\"30%\"><b>Command<\/b><\/td>\n<td width=\"70%\"><b>Technical Behavior &amp; Impact<\/b><\/td>\n<\/tr>\n<tr>\n<td>ClientShutdown<\/td>\n<td><b>Kill Switch<\/b>: Gracefully shuts down the communication socket (SocketShutdown.Both) and invokes Environment.Exit(0) to immediately kill the process<\/td>\n<\/tr>\n<tr>\n<td>ClientDelete<\/td>\n<td><b>Self-Deletion<\/b>: An uninstallation routine designed to wipe traces of the malware from the disk and registry to obstruct forensic analysis<\/td>\n<\/tr>\n<tr>\n<td>ClientUpdate<\/td>\n<td><b>Remote Update<\/b>: Drops a newly received payload binary into the %TEMP% directory, executes it quietly, and optionally triggers the self-delete mechanism on the older version<\/td>\n<\/tr>\n<tr>\n<td>Ping<\/td>\n<td><b>Heartbeat<\/b>: A keep-alive mechanism to signal to the C2 panel that the infected node remains active and ready for instructions<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u00a0<\/p>\n<p style=\"\tmargin-left: 40.0px;\n\">2. <b>Surveillance and Remote Monitoring Commands:<\/b> These capabilities grant the attacker real-time observation and interactive capability over the user&#8217;s desktop environment.\n<\/p>\n<table border=\"1\" cellpadding=\"0\" cellspacing=\"0\" class=\"details-tbl\" style=\"\tmargin-left: 40.0px;\n\" width=\"95%\"><\/p>\n<tbody>\n<tr>\n<td width=\"30%\"><b>Command<\/b><\/td>\n<td width=\"70%\"><b>Technical Behavior &amp; Impact<\/b><\/td>\n<\/tr>\n<tr>\n<td>RemoteDesktopOpen<\/td>\n<td><b>Reconnaissance<\/b>: Queries the system monitor topology using Screen.AllScreens.Length and exfiltrates screen dimensions back to the handler<\/td>\n<\/tr>\n<tr>\n<td>RemoteDesktopSend<\/td>\n<td><b>Screen Exfiltration<\/b>: Captures screenshots using Graphics.CopyFromScreen, scales and compresses the frame into a JPEG format via specified encoder quality parameters to preserve bandwidth, and sends the raw bytes back to the C2<\/td>\n<\/tr>\n<tr>\n<td>mousemove<\/td>\n<td><b>Input Mocking<\/b>: Provisioned to parse mouse coordinates and simulate user input<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n-->\n<\/div>\n<div class=\"cmp cmp-text\">\n<p style=\"\tmargin-left: 40.0px;\n\">3.<b> Advanced Execution &amp; Evasion:<\/b> This category represents the highest risk score within the payload, leveraging the .NET framework&#8217;s modularity to bypass traditional Endpoint Detection and Response (EDR) solutions.<\/p>\n<table border=\"1\" cellpadding=\"0\" cellspacing=\"0\" class=\"details-tbl\" style=\"\tmargin-left: 40.0px;\n\" width=\"95%\"><\/p>\n<tbody>\n<tr>\n<td width=\"30%\"><b>Command<\/b><\/td>\n<td width=\"70%\"><b>Technical Behavior &amp; Impact<\/b><\/td>\n<\/tr>\n<tr>\n<td>Reflection<\/td>\n<td><b>Fileless Assembly Loading<\/b>: Leverages Assembly.Load to dynamically parse a .NET DLL byte array directly into memory and call its EntryPoint. Because the payload never touches the physical disk, it effectively evades traditional static file scanning<\/td>\n<\/tr>\n<tr>\n<td>RunPE<\/td>\n<td><b>Process Hollowing<\/b>: Injects malicious code blocks into a legitimate, trusted system process space (e.g., explorer.exe or svchost.exe). This masks the malicious network connections and resource usage behind a trusted Windows process image<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n-->\n<\/div>\n<div class=\"cmp cmp-text\">\n<p style=\"\tmargin-left: 40.0px;\n\">The communication layer is equally revealing. The malware serializes outbound objects, encrypts them using RijndaelManaged in ECB mode, and derives its encryption key from MD5. Inbound payloads are decrypted using the same static-key mechanism. Outbound data is prefixed with a custom length header and then written asynchronously to a socket. This confirms a stateful RAT architecture with custom serialization, encrypted transport, and persistent client-server interaction rather than a series of disconnected download events.\u00a0<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n-->\n<\/div>\n<div class=\"cmp cmp-text\">\n<p style=\"\tmargin-left: 40.0px;\n\">Another .NET file from <b>RtkLoggingManifest.man<\/b> is AsyncRAT with a C2 address of 107[.]172[.]10[.]190.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 33: AsyncRAT<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>Conclusion<\/h2>\n<p>This attack chain functions as a fully realized multi-stage intrusion framework, purpose-built for stealthy payload delivery, modular execution, and long-term remote access, ultimately culminating in the deployment of a feature-rich .NET Remote Access Trojan.<\/p>\n<p>Notably, several characteristics of the intermediate-stage scripts suggest AI-assisted development. The use of Simplified Chinese variable names throughout the PowerShell components, combined with an unsanitized Simplified Chinese comment and an emoji annotation left in the staging script, indicates that AI-generated output was deployed without adequate review or cleanup. While the overall attack logic reflects deliberate human design, these overlooked artifacts indicate a workflow in which generative AI tooling was used to accelerate implementation.<\/p>\n<p>Users are strongly advised to exercise caution when handling shortcut files (.lnk), compressed archives, or documents from untrusted sources. Regularly auditing startup entries, scheduled tasks, and registry keys for unauthorized modifications, as well as monitoring for anomalous PowerShell execution and unexpected outbound network connections, are essential defensive measures.<\/p>\n<h2>Fortinet Protections<\/h2>\n<p>The malware described in this report are detected and blocked by FortiGuard Antivirus as:<\/p>\n<p style=\"\tmargin-left: 40.0px;\n\"><b>LNK\/Agent.MQOEQT!tr<br \/>\n MSIL\/Agent.CDW!tr<br \/>\n POWERSHELL\/Agent.CA!tr<\/b><\/p>\n<p>The <a aria-label=\"FortiGuard AntiVirus service\" href=\"\/support\/support-services\/fortiguard-security-subscriptions\/antivirus\" title=\"FortiGuard AntiVirus service\">FortiGuard AntiVirus service<\/a> engine is integrated into <a aria-label=\"FortiGate\" href=\"\/products\/next-generation-firewall\" title=\"FortiGate\">FortiGate<\/a>, <a aria-label=\"FortiMail\" href=\"\/products\/email-security\" title=\"FortiMail\">FortiMail<\/a>, <a aria-label=\"FortiClient\" href=\"\/products\/endpoint-security\/forticlient\" title=\"FortiClient\">FortiClient<\/a>, and <a aria-label=\"FortiEDR\" href=\"\/products\/endpoint-security\/fortiedr\" title=\"FortiEDR\">FortiEDR<\/a>. Customers running these products with up-to-date signatures are protected against the malware components described in this report.<\/p>\n<p>The <a aria-label=\"FortiGuard Web Filtering Service\" href=\"https:\/\/www.fortiguard.com\/services\/wf\" rel=\"noopener noreferrer\" target=\"_blank\" title=\"FortiGuard Web Filtering Service\">FortiGuard Web Filtering Service<\/a> blocks the C2 server.<\/p>\n<p>Organizations seeking to strengthen foundational security awareness may also consider completing <a aria-label=\"Fortinet Certified Fundamentals\" href=\"https:\/\/training.fortinet.com\/local\/staticpage\/view.php?page=fcf_cybersecurity\" rel=\"noopener noreferrer\" target=\"_blank\" title=\"Fortinet Certified Fundamentals\">Fortinet Certified Fundamentals<\/a> (FCF) training in Cybersecurity.\u00a0 This module is designed to help end users learn to identify and protect themselves from phishing attacks.<\/p>\n<p>The <a aria-label=\"FortiGuard IP Reputation and Anti-Botnet Security Service\" href=\"\/support\/support-services\/fortiguard-security-subscriptions\/ipreputation-antibot\" title=\"FortiGuard IP Reputation and Anti-Botnet Security Service\">FortiGuard IP Reputation and Anti-Botnet Security Service<\/a> proactively blocks infrastructure associated with this campaign by correlating malicious IP intelligence collected from Fortinet\u2019s global sensor network, CERT collaborations, MITRE, trusted industry partners, and other intelligence sources.<\/p>\n<p>If you believe this or any other cybersecurity threat has impacted your organization, contact our Global <a aria-label=\"FortiGuard Incident Response Team\" href=\"https:\/\/www.fortiguard.com\/faq\/csirt-contact\" rel=\"noopener noreferrer\" target=\"_blank\" title=\"FortiGuard Incident Response Team\">FortiGuard Incident Response Team<\/a> for assistance.<\/p>\n<h2>IOCs<\/h2>\n<h3>IP<\/h3>\n<p>107[.]172[.]10[.]190<\/p>\n<h3>Domains<\/h3>\n<p>Shampobiskworld[.]nl<br \/>\nshampoolagtto[.]com<br \/>\nshamppocosmaticso[.]com<\/p>\n<h3>Hashes<\/h3>\n<p><b>LNK<\/b><br \/>\n61b7fa5a7186cbf73dbc1f03e6e6f6819f5eb1e630a001059d381114bda2f974<\/p>\n<p><b>POWERSHELL<\/b><br \/>\n7d6ee3c6ff8f70b1817aaec82aff1d2babe0b62cafef3975262644743afc0cb8<\/p>\n<p><b>EXE<\/b><br \/>\n96b486bd7308ef3d6771360800f4c9b48b10697bd4cb69a8589b97b039377ecb<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Affected Platforms: Microsoft Windows<br \/>\nImpacted Users: Any organization<br \/>\nImpact: Attackers gain control of the infected systems<br \/>\nSeverity Level: High<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10424,10378,32774],"tags":[],"class_list":["post-26149","post","type-post","status-publish","format-standard","hentry","category-fortinet","category-security","category-threats"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26149"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26149\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26149"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}