AHK Bot

AHK Bot is a modular AutoHotKey-based malware family used in intrusion activity attributed to TA866, also known as Asylum Ambuscade. It has been observed as a post-exploitation payload delivered after earlier stages such as JavaScript downloaders, WasabiSeed, and Screenshotter in campaigns that used malspam, thread hijacking, malicious attachments or URLs, 404 TDS, and later PDF attachments containing OneDrive links. Proofpoint observed AHK Bot in TA866 campaigns during late 2022, and Cisco Talos reported TA866 frequently deploying it on infected systems. Prior reporting also notes delivery alongside Rhadamanthys Stealer.

AHK Bot supports persistence, system enumeration, screenshot capture, domain identification, secondary command-and-control connection establishment, keystroke logging, credential theft, hVNC deployment and removal, and deployment and removal of remote access software. It establishes persistence by creating an LNK shortcut in the Windows Startup directory and polls C2 for additional scripts. Observed AHK Bot functionality includes a system enumeration script that collects OS, hardware, disk, processor, RAM, GPU, networking, security software, and running process information and uploads it to C2; a Domain Profiler component that determines the victim machine’s Active Directory domain and sends it to C2; and a browser credential theft script targeting Internet Explorer, Mozilla Firefox, and Chromium-based browsers. Proofpoint also reported a Stealer Loader component that downloaded, decrypted, and executed a DLL in memory, with an observed payload being Rhadamanthys Stealer.

In observed TA866 activity, AHK Bot used the victim C: drive serial number in C2 URL paths and polled a separate hardcoded C2 distinct from WasabiSeed infrastructure. Proofpoint reported AHK Bot C2 activity involving hxxp://89[.]208.105.255/%serial%-du2, hxxp://89[.]208.105.255/%serial%, and hxxp://89[.]208.105.255/download?path=e. Cisco Talos also reported TA866 using AHK Bot to retrieve DLL-based shellcode loaders and execute Rhadamanthys in memory. Russian-language comments and variable names were identified in parts of AHK Bot code, and Talos noted Russian comments in related AHK Screenshotter code. Victimology associated with TA866 campaigns included organizations primarily in the United States, with additional targeting in Germany and other countries; Talos reported manufacturing as the most affected sector, followed by government and financial services.