A Telegram Seller Turns Malware Scanners Against Websites

A seller builds real remote-access malware, points it at websites someone wants taken down, and lets malware scanners do the accusing. We found it by pulling on a routine AsyncRAT spike.

Key findings

• Malware scanners and sandboxes such as Filescan, VirusTotal and Triage run suspicious files and list the servers each file connects to, among other things. Security products then use those lists to block websites.
• This operator turns that around. They build hacking tools whose “server” is a website they want gone: a rival betting site, a betting mirror, an SEO page. Then they upload the tools to every scanner at once. The scanners do their job and label the website “malware infrastructure”. Blocklists, browsers and domain registrars follow.
• A Telegram account whose name is embedded in the samples sells exactly this.

How the frame works

1. Pick a targetA website someone wants offline, like a rival betting site.
2. Build a RAT for itCommon malware, with the target set as its server.
3. Upload everywhere at onceThe same file goes to several sandboxes.
4. Sandboxes "find" a C2They list the website as the malware's server.
5. The reputation spreadsThreat feeds and security vendors flag the site.
6. File the abuse reportThe sandbox reports become evidence to take the site down.

Where it started: an ordinary AsyncRAT spike

In late October 2026 we ran a routine hunting session on Filescan with an AI agent connected through the MetaDefender Aether MCP. The agent noticed a spike in AsyncRAT detections between 20 and 31 October.

AsyncRAT showing up is not unusual. It is free remote-access malware and sandboxes see it every day. The odd part was where these samples said they would connect.

A RAT usually carries a small configuration block, and sandboxes can decode it. That block names the command-and-control (C2) server the malware reports to. In this spike, the C2 servers had a lot in common:

• Vietnamese online betting brands, such as jun88, 789bet, ae888, ga888 and qh88, plus live-streamed cockfight betting.
• Mirror and proxy domains for those brands. Betting sites are blocked often, so they rotate through many alternate addresses on cheap domain endings, such as .lol, .tech or .com.cv, that send players to the real site.
• SEO pages that exist to link to those mirrors.
• Almost all of them are ordinary websites behind Cloudflare that serve a normal web page.
• Often the file was simply named after its target: the mirror’s domain name with .exe on the end.

Real criminals don’t usually run their malware servers on well-known betting brands. That was the first thread.

The malware can’t work

The extracted AsyncRAT configuration also contains the RAT’s server certificate. AsyncRAT talks to its server over TLS, the same encryption a browser uses. But it does not trust any valid certificate. It only accepts the exact certificate baked into its config, a practice called certificate pinning. If the server presents anything else, the malware drops the connection.

We checked the targets with a harmless TLS handshake. They present ordinary public certificates for their own domain, mostly from Let’s Encrypt or Google. None of them could present the RAT’s own self-signed certificate. So these AsyncRAT builds could never connect to their “C2”. As malware they are useless.

So why would anyone keep building AsyncRAT samples that can’t work, all pointing at the same kind of website?

Going back in time

We followed the same settings, naming habits and targets backwards. The trail did not start in October. It went back eight months. Newest first:

1. October 2026The spike we started from: AsyncRAT builds aimed at betting sites, arriving in a steady stream. Files named after the seller appear.
2. September – October 2026Many builds switch to Remcos, which can hold a list of servers. Each build frames 3 to 22 sites at once.
3. April – August 2026Builds named MalwareRAT.exe, TrojanRAT.exe and Backdoor.exe, made to look as malicious as possible.
4. February 2026The earliest builds we can tie to the operator in our corpus. The targets are Vietnamese cockfight-betting sites.

A betting war? Not quite

Our first guess was an adversarial betting scheme: one betting operator framing its competitors as malware hosts so that they get blocked and lose players.

The data didn’t support that. A single build often lists several competing brands side by side, and over time many rival brands were targeted. No single operator would frame itself and its rivals in the same file.

That pattern fits a service better than a rivalry: someone who takes orders from many customers, each with a different site to bring down.

Built to be caught

Real malware authors try to stay hidden. This operator hardly tries. Almost every choice we found makes the files easier to detect and the target easier to name:

• Default settings, untouched. Certificates still named AsyncRAT Server or Quasar Server CA. Quasar keeps the default tag Office04 and Run key Quasar Client Startup. These defaults are among the first things detection rules look for.
• Incriminating subdomains. Targets are listed with malware., backdoor., c2. and api. in front of the victim’s domain, so the report reads like proof.
• Self-labelling file names. MalwareRAT.exe, TrojanRAT.exe, Backdoor.exe, QuasarRAT.exe, AsyncRAT.exe, or simply the target’s domain.
• Uploaded everywhere at once. The same file reaches several sandboxes, including Filescan, VirusTotal and Triage, at almost the same moment.
• A scheduler, not a person. In October a new build arrived every 606 seconds. A fixed rhythm like that points to an automated pipeline, not someone uploading by hand.
• Well-known families. In everything we found, the operator used AsyncRAT, Quasar and Remcos, plus one fake “ransomware” build. AsyncRAT and Quasar are open source on GitHub, and cracked Remcos builders circulate widely. All three have mature config extractors, so sandboxes reliably pull out the “C2” and name the family with confidence. A custom family would get a vague “suspicious” verdict and no domain at all.

The effect can reach well beyond one sandbox. Threat-intelligence platforms that collect C2 addresses from sandbox results, such as abuse.ch ThreatFox, can end up listing the domain, and security vendors can recategorise it as “command and control”. That is why the domains in these files should be treated as victims, not attackers.

Who is behind it: a Telegram handle in the file names

While going through the October builds, we found at least 22 Filescan reports for files named [email protected] (20–31 October). The tele@ prefix reads as a Telegram handle. The name is also inside the malware itself: in one AsyncRAT build (Filescan report e430e0b4, 30 October), the extracted config shows the install file name VietNamReport.exe.

These builds belong to the same operation:

• They frame the same targets. The qh88 betting domain named in that AsyncRAT build appears as a “C2” in 53 Filescan reports, many of them from the October wave.
• They use the same tricks: Remcos builds with long target lists, and victims listed with backdoor., c2. and malware. subdomains.
• They follow the same AsyncRAT setup as the rest of the October builds.

Disclaimer. Vietnam Report JSC (vietnamreport.net) is a legitimate Vietnamese company. It has nothing to do with this activity. The only link is a similar name.

The Telegram account

The handle exists: t.me/VietNamReport, display name “Report Domain”. It is a personal profile with no posts, only a bio and a message button. The bio, in Vietnamese:

“Bán malware hỗ trợ report / Đào tạo report. Nhận rp GoDaddy-Dynadot”

“Selling malware to support [abuse] reports / Report training. Taking report jobs for GoDaddy and Dynadot.”

GoDaddy and Dynadot are domain registrars. A registrar can suspend a domain after an abuse report, and a sandbox report showing “malware C2” is exactly the kind of evidence such a report needs.

Telegram does not publish when an account was created, but third-party tools estimate it from the account ID. GramGPT puts this account at about October 2025 (±13 days), roughly a year old.

The Telegram profile, captured Saturday 31 October 2026. The profile photo behind the name is a WHOIS record.

The profile photo is a trophy

The account’s profile photo is a WHOIS screenshot of way2ship.in. Its status is clientHold, and the record was last updated on 20 October 2026.

clientHold is a status the registrar sets. The owner still holds the domain, but the registry stops publishing it in DNS, so the website and its email stop working everywhere until the registrar lifts the hold. Registrars use it for abuse complaints, unpaid bills or unverified owner details. For a business, it means the site is offline.

That domain is in our data. 68 Filescan reports list way2ship.in as their “C2”, all uploaded between 13 and 20 October; every one we opened is a Remcos build. The last is a [email protected] build on 20 October, the same day the WHOIS record was last updated.

We can’t prove the abuse reports caused the hold. But the seller chose this domain as the face of the shop, and it matches a week of framing builds in our corpus.

Want to run your own hunt? Connect the MetaDefender Aether MCP to your AI assistant, give it a goal, and see what it finds on filescan.io.