Tag: cloudflare tunnels

4 Attack Reports | 0 Vulnerabilities

Attack reports

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset

Throughout 2024, Gamaredon focused exclusively on targeting Ukrainian governmental institutions with spearphishing campaigns and weaponized USB drives. The group developed six new tools and significantly updated existing ones, improving stealth and evasion capabilities. Gamaredon increased the scal…
apt
spearphishing
powershell
cloudflare tunnels
2025-07-04
Published: July 4, 2025
Downloadable IOCs: 53

Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware

The SERPENTINE#CLOUD campaign leverages Cloudflare Tunnels and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts. The attack begins with malicious .lnk files disguised as documents, fetching remote code from Cloudflare subdomains. The …
obfuscation
rat
phishing
asyncrat
webdav
stealth techniques
memory injection
cloudflare tunnels
shellcode loader
2025-06-20
revengerat
python-based malware
donut packer
Published: June 20, 2025
Downloadable IOCs: 147

Leveraging Cloudflare Tunnels for GammaDrop Infrastructure

BlueAlpha, a Russian state-sponsored cyber threat group, has evolved its malware delivery tactics by exploiting Cloudflare Tunnels to conceal GammaDrop staging infrastructure. The group employs HTML smuggling with sophisticated modifications to bypass email security systems and uses DNS fast-fluxin…
apt
spearphishing
html smuggling
2024-12-05
gammadrop
obfuscation techniques
gammaload
cloudflare tunnels
russian state-sponsored
dns fast-fluxing
Published: December 5, 2024
Downloadable IOCs: 1

BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure

BlueAlpha, a Russian state-sponsored cyber threat group, has evolved its malware delivery tactics by exploiting Cloudflare Tunnels to conceal GammaDrop staging infrastructure. The group employs HTML smuggling with sophisticated modifications to bypass email security systems and uses DNS fast-fluxin…
apt
spearphishing
html smuggling
2024-12-05
gammadrop
obfuscation techniques
gammaload
cloudflare tunnels
russian state-sponsored
dns fast-fluxing
Published: December 5, 2024
Downloadable IOCs: 0
Click here to see more Attack Reports