Hackers Abuse Cloudflare Tunnel Infrastructure to Deliver Multiple RATs

The evolution of this attack campaign demonstrates how threat actors continuously adapt their techniques to bypass security controls, emphasizing the importance of multi-layered detection approaches and continuous monitoring for similar attack patterns. The attachment typically uses the “application/windows-library+xml” file format, which frequently bypasses email security gateways due to its seemingly innocuous nature compared to binary files. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Cybersecurity experts have identified a sophisticated attack campaign exploiting Cloudflare’s tunnel infrastructure to distribute various remote access trojans (RATs). The infrastructure, which has demonstrated remarkable resilience since February 2024, serves as a distribution platform for malicious files and trojans that enable attackers to gain unauthorized access to victims’ systems. The complexity of this attack demonstrates how threat actors continue to develop innovative methods to bypass modern security controls, even in 2025. This script triggers a BAT file that installs Python and executes obfuscated Python code, which then injects the next payload stage into “notepad.exe” processes. The attackers leverage domains with the “trycloudflare.com” suffix, including “malawi-light-pill-bolt.trycloudflare.com,” “players-time-corresponding-th.trycloudflare.com,” and others to host their malicious content. Security vendors including Forcepoint, Fortinet, Orange, and Proofpoint have documented this persistent threat, highlighting its evolving nature and growing impact on organizations worldwide. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. When opened, this file establishes a connection to a remote WebDav resource hosted on the Cloudflare tunnel infrastructure. This infrastructure delivers payloads that ultimately establish persistent remote access to compromised systems, potentially enabling data theft and further network compromise. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Their analysis reveals an intricate multi-stage infection chain that employs various obfuscation techniques to evade detection systems. This establishes the RAT’s connection to its command and control server, often using dynamic DNS services like “duckdns.org” for communication.

This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 22 Apr 2025 21:05:08 +0000


Cyber News related to Hackers Abuse Cloudflare Tunnel Infrastructure to Deliver Multiple RATs

Cloudflare discloses breach related to stolen Okta data - Last fall, Cloudflare announced it mitigated an attempted cyberattack stemming from the infamous Okta breach. Cloudflare disclosed in a blog post that it had been breached by an unnamed nation-state threat actor using an access token and three ...
1 year ago Techtarget.com
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
1 year ago Esecurityplanet.com
Cloudflare Dashboard and APIs down after data center power outage - An ongoing Cloudflare outage has taken down many of its products, including the company's dashboard and related application programming interfaces customers use to manage and read service configurations. The complete list of services whose ...
1 year ago Bleepingcomputer.com
Polyfill.io, BootCDN, Bootcss, Staticfile attack traced to 1 operator - The recent large scale supply chain attack conducted via multiple CDNs, namely Polyfill.io, BootCDN, Bootcss, and Staticfile that affected anywhere from 100,000 to tens of millions of websites has been traced to a common operator, according to ...
9 months ago Bleepingcomputer.com
How to Arm Yourself With CloudFlare Security Solutions - Securing your website or digital asset is a critical part of running a successful business or website. With the rise of the digital era, the need to protect yourself from cyber-attacks is essential. That's why CloudFlare, the leading cloud solution ...
2 years ago Blog.cloudflare.com
Hackers Abuse Cloudflare Tunnel Infrastructure to Deliver Multiple RATs - The evolution of this attack campaign demonstrates how threat actors continuously adapt their techniques to bypass security controls, emphasizing the importance of multi-layered detection approaches and continuous monitoring for similar attack ...
5 hours ago Cybersecuritynews.com
CVE-2024-49940 - In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the ...
6 months ago Tenable.com
Cloudflare publishes details of Thanksgiving security breach The Register - Cloudflare has just detailed how suspected government spies gained access to its internal Atlassian installation using credentials stolen via a security breach at Okta in October. In a write-up on Thursday, CEO Matthew Prince, CTO John ...
1 year ago Go.theregister.com
Hackers Abuse Cloudflare Services for Sophisticated Phishing Attacks - The attacks, which began emerging in early 2025, leverage Cloudflare Workers and Pages to host malicious content that easily bypasses traditional security filters due to the trusted nature of Cloudflare’s infrastructure. Cybersecurity experts ...
2 weeks ago Cybersecuritynews.com
Cloudflare R2 service outage caused by password rotation error - The absence of safeguards and validation checks for high-impact actions led to the outage, prompting Cloudflare to plan and implement additional measures for improved account provisioning, stricter access control, and two-party approval processes for ...
4 weeks ago Bleepingcomputer.com
Cloudflare hacked using auth tokens stolen in Okta attack - Cloudflare disclosed today that its internal Atlassian server was breached by a 'nation state' attacker who accessed its Confluence wiki, Jira bug database, and Atlassian Bitbucket source code management system. The threat actor first gained access ...
1 year ago Bleepingcomputer.com
Cloudflare Expands Zero Trust Capabilities with Acquisition of BastionZero - Technology vendor Cloudflare on Thursday announced the acquisition of seed-stage startup BastionZero as part of plans to expand the scope of its VPN replacement solutions. BastionZero, based in Boston, Mass., raised $6 million in seed capital from ...
10 months ago Securityweek.com
Cybersecurity Crisis Looms: FBI Chief Unveils Chinese Hackers' Plan to Target US Infrastructure - As the head of the FBI pointed out Wednesday, Beijing was positioning itself to disrupt the daily lives of Americans if there was ever a war between the United States and China if it were to plant malware to damage civilian infrastructure. U.S. ...
1 year ago Cysecurity.news Volt Typhoon
Cloudflare Incident on January 24th, 2023 - An Overview - On January 24th, 2023, Cloudflare experienced an incident that impacted its customers globally. In this article, we will provide an overview analysis of the incident, its impacts on SEO, security, threats, etc. ...
2 years ago Blog.cloudflare.com
The Unlikely Romance of Hackers and Government Suitors - The annual Hack the Capitol event brings together a diverse group of scientists, hackers, and policymakers to educate congressional staffers, scholars, and the press about the most critical cybersecurity challenges facing our nation. Hack the Capitol ...
1 year ago Darkreading.com
Cloudflare loses 22% of its domains in Freenom.tk shutdown - A staggering 12.6 million domains on TLDs controlled by Freenom have been shut down and no longer resolve, leading to a significant reduction in the number of websites hosted by Cloudflare. The disappearance of these websites was spotted during our ...
1 year ago Netcraft.com
Digital Battlefield: Syrian Threat Group's Sinister SilverRAT Emerges - Cyfirma claims that the developers maintain a sophisticated and active presence on multiple hacker forums and social media platforms, as outlined by the cybersecurity company. Besides operating a Telegram channel offering leaked databases, carding ...
1 year ago Cysecurity.news
How Hackers Interrupted GTA 5 Online Gameplay on PC - Recently, a cyber-attack on Grand Theft Auto 5 Online on PC caused an interruption to thousands of players’ gameplays. The game was completely taken offline and players couldn’t even access the main gameplay menu. The attack caused an uproar ...
2 years ago Hackread.com
What's new in the MSRC Report Abuse Portal and API - The Microsoft Security Response Center has always been at the forefront of addressing cyber threats, privacy issues, and abuse arising from Microsoft Online Services. Building on our commitment, we have introduced several key updates to the Report ...
9 months ago Msrc.microsoft.com
CloudFlare Network Performance Update: A CIO Edition - Nowadays, more organizations than ever are relying on CloudFlare's global infrastructure to ensure the best performance for their websites and services. This is no different for companies that have a Chief Information Officer (CIO). With the dramatic ...
2 years ago Blog.cloudflare.com
Cloudflare Attributes Recent Service Outage to Password Rotation Error - “This incident happened because of human error and lasted longer than it should have because we didn’t have proper visibility into which credentials were being used by the Gateway Worker to authenticate with our storage ...
3 weeks ago Cybersecuritynews.com
Cloudflare Acquires Zaraz to Improve Cloud Loading of Third-Party Tools - Cloudflare, the global leader in cloud performance and security, has announced the acquisition of Zaraz, a leading provider of cloud server loading technology. The acquisition will enable Cloudflare to provide automated access to third-party tools, ...
2 years ago Blog.cloudflare.com
Announcing Custom DLP Profiles for Data Loss Prevention - Do you have questions about where your sensitive data is stored and who can access it? Does your organization need more visibility and control over their data? Cloudflare One offers customers Data Loss Prevention (DLP) that is designed to give ...
2 years ago Blog.cloudflare.com
Cloudflare to Close All HTTP Ports for APIs, Enforces HTTPS Connection - “A better approach is to refuse the underlying cleartext connection by closing the network ports used for plaintext HTTP, and that’s exactly what we’re going to do for our customers,” stated Cloudflare in their announcement ...
1 month ago Cybersecuritynews.com
A Plan to Protect Critical Infrastructure from 21st Century Threats - On April 30th, the White House released National Security Memorandum-22 on Critical Infrastructure Security and Resilience, which updates national policy on how the U.S. government protects and secures critical infrastructure from cyber and ...
10 months ago Cisa.gov

Latest Cyber News


Cyber Trends (last 7 days)