Attackers in the SMOKE#SCREEN campaign used Cloudflare Quick Tunnel to expose a staging server temporarily, leveraging a service that is rarely monitored. The server runs cloudflared.exe to generate ephemeral tunnels for C2 and payload delivery.
Attackers in the SMOKE#SCREEN campaign used Cloudflare Quick Tunnel to expose a staging server temporarily, leveraging a service that is rarely monitored. The server runs cloudflared.exe to generate ephemeral tunnels for C2 and payload delivery.