Cybercriminals Abusing Cloudflare Tunnels to Evade Detection and Spread Malware
Cybersecurity firms are alerting the public to a rise in the misuse of Clouflare's free TryCloudflare service to distribute malware.
The behavior, which is recorded by Proofpoint and eSentire, involves using TryCloudflare to establish a one-time tunnel that relays traffic across Cloudflare's infrastructure from an attacker-controlled server to a local machine.
Attack chains that employ this tactic have been seen to distribute a variety of malware families, including XWorm, Remcos RAT, GuLoader, PureLogs Stealer, and AsyncRAT.
A phishing email with a ZIP package and a URL shortcut file within directs the recipient of the message to a Windows shortcut file stored on a WebDAV server that is proxied by TryCloudflare read more about Cybercriminals Abusing Cloudflare Tunnels to Evade D...