Cybercriminals are increasingly leveraging Cloudflare’s TryCloudflare tunnels to deliver remote access trojans (RATs) like Xworm, AsyncRAT, Remcos RAT, and VenomRAT. Proofpoint and other cybersecurity researchers have identified a surge in these attacks, which predominantly target organizations through phishing emails containing URLs or attachments. These emails often lead to the installation of malware, employing sophisticated techniques to bypass traditional security measures.
The attackers create temporary, one-time tunnels through Cloudflare’s infrastructure, making it challenging for organizations to block these malicious activities. This abuse of legitimate services facilitates the evasion of detection and the propagation of malware. The infection chain usually involves a combination of Python scripts, BAT or CMD files, and PowerShell scripts, ensuring the malware can execute on systems without the need for pre-installed Python.
In addition to technical obfuscation methods, cybercriminals use direct syscalls and decoy PDFs to further evade security measures. The constantly evolving nature of these campaigns, coupled with the use of temporary Cloudflare instances, exacerbates the difficulty in preventing and detecting such attacks.
Organizations are advised to implement strict endpoint detections, monitor outgoing connections to <a href="http://trycloudflare.com" target="_blank" rel="noopener nofollow">trycloudflare.com</a> URLs, and restrict unnecessary software and external file-sharing services to mitigate risks effectively. By enhancing these security measures, enterprises can better safeguard themselves against the growing misuse of Cloudflare services in cyber attacks.

Collections

Cybercriminals are exploiting Cloudflare's TryCloudflare tunnels to deliver remote access trojans (RATs) like Xworm, AsyncRAT, Remcos RAT, and VenomRAT via phishing emails. These attacks employ sophisticated techniques to bypass traditional security measures using temporary tunnels, Python scripts, BAT or CMD files, and PowerShell scripts. Organizations are advised to enhance endpoint detection and monitor connections to mitigate these risks.

Cybercriminals Exploit Cloudflare Tunnels to Spread Remote Access Trojans