New Malware Campaign Uses Cloudflare Tunnels to Deliver RATs via Phishing Chains

In the ever-evolving landscape of cybersecurity, threat actors are constantly on the lookout for innovative methods to bypass security protocols and exploit vulnerabilities. One such method has been observed in a new malware campaign, codenamed SERPENTINE#CLOUD by Securonix. This campaign employs Cloudflare Tunnel subdomains to host malicious payloads and deliver them via phishing chains. In this blog post, we’ll delve into the details of this campaign, its implications, and how businesses can protect themselves from such sophisticated attacks.

Understanding the SERPENTINE#CLOUD Campaign

The Role of Cloudflare Tunnels

Cloudflare Tunnels have been leveraged in this campaign to obscure malicious activities under the guise of legitimate web traffic. By using subdomains that appear reputable, threat actors are able to evade detection mechanisms that rely on domain-based filtering. This tactic exemplifies a growing trend where cybercriminals exploit trusted cloud service providers to conduct their illicit operations.

The Attack Vector

The attack begins with phishing emails that are themed around payments or invoices. These emails contain links to zipped documents, which in turn include Windows shortcut (LNK) files disguised as legitimate documents. Once a victim opens these shortcuts, the infection sequence is activated, ultimately executing a Python-based shellcode loader. This loader delivers payloads packed with the open-source Donut loader, running entirely in memory to evade traditional endpoint detection systems.

Targeted Regions and Tactics

The SERPENTINE#CLOUD campaign has primarily targeted regions in the United States, United Kingdom, Germany, and various parts of Europe and Asia. Notably, the campaign’s initial access methods have evolved, shifting from internet shortcut (URL) files to LNK files masquerading as PDF documents. These files retrieve additional stages over WebDAV via Cloudflare Tunnel subdomains.

The Evolution of Malware Delivery

A Continuation of Previous Campaigns?

This isn’t the first time a campaign of this nature has been documented. Variations of these tactics were previously observed by cybersecurity firms eSentire and Proofpoint, which paved the way for the deployment of RATs like AsyncRAT, GuLoader, and others. While there are similarities in the infrastructure and delivery mechanics, there are also notable differences in payload complexity and targeting, suggesting either a retooling by the same threat actors or the emergence of new actors using established methods.

The Abuse of Cloudflare Tunnels

The use of Cloudflare Tunnels provides multiple advantages to threat actors. By routing malicious activities through a recognized and trusted service, it becomes significantly challenging for cybersecurity professionals to distinguish between legitimate and malicious activities. This technique effectively evades URL or domain-based blocking mechanisms, allowing malicious payloads to pass unnoticed through defenses.

The Infection Sequence

Upon launching the LNK files, a next-stage payload, typically a Windows Script File (WSF), is downloaded from a remote WebDAV share hosted on a Cloudflare Tunnel subdomain. This WSF file, executed using cscript.exe, acts as a lightweight loader, initiating further scripts and ultimately delivering the main payload. The use of extensive code obfuscation and additional stages aids in sliding under the radar, making detection and prevention even more challenging.

Protecting Against SERPENTINE#CLOUD

Implementing Robust Email Security

Given that the initial attack vector is phishing emails, implementing advanced email security solutions is crucial. Businesses should employ systems that can detect and block malicious attachments and links before they reach end-users.

Enhancing Endpoint Security

Deploying endpoint detection and response (EDR) solutions can help identify and mitigate threats that operate in memory. These solutions should be capable of detecting abnormal behaviors and patterns indicative of in-memory payloads.

User Education and Awareness

Regular training programs aimed at increasing awareness among employees about phishing tactics and suspicious email indicators can significantly reduce the risk of successful malware deployment.

Conclusion

The SERPENTINE#CLOUD campaign highlights the sophistication and adaptability of modern cyber threats. By exploiting trusted services like Cloudflare Tunnels and employing complex infection sequences, threat actors are continually evolving to bypass traditional security measures. To protect against such threats, organizations must adopt a multi-layered security approach, combining advanced technology solutions with ongoing user education.

FAQ

What is the SERPENTINE#CLOUD campaign?

SERPENTINE#CLOUD is a malware campaign identified by Securonix that uses Cloudflare Tunnel subdomains to host and deliver malicious payloads via phishing emails. The campaign employs sophisticated techniques to evade detection and has targeted regions in the U.S., U.K., Germany, and other parts of Europe and Asia.

How do Cloudflare Tunnels assist in malware delivery?

Cloudflare Tunnels allow threat actors to route malicious activities through trusted subdomains, making it difficult for defenders to distinguish between legitimate and harmful actions. This method helps evade domain-based blocking mechanisms and enhances the stealth of the campaign.

What can businesses do to protect themselves from such campaigns?

Businesses should implement robust email security solutions, enhance endpoint security with EDR systems, and conduct regular user education programs to increase awareness about phishing tactics and suspicious emails.

Are there similarities between SERPENTINE#CLOUD and previous campaigns?

Yes, there are similarities in infrastructure and delivery mechanics between SERPENTINE#CLOUD and previous campaigns documented by eSentire and Proofpoint. However, differences in payload complexity and targeting suggest either a retooling by the same actors or the emergence of new actors using established methods.

Why is user education important in combating phishing attacks?

User education is critical because it equips employees with the knowledge to recognize and respond to phishing attempts. By understanding the signs of malicious emails, users can act as an additional line of defense, reducing the likelihood of successful attacks.

Discover more at InnoVirtuoso.com

I would love some feedback on my writing so if you have any, please don’t hesitate to leave a comment around here or in any platforms that is convenient for you.

For more on tech and other topics, explore InnoVirtuoso.com anytime. Subscribe to my newsletter and join our growing community—we’ll create something magical together. I promise, it’ll never be boring! 

Stay updated with the latest news—subscribe to our newsletter today!

Thank you all—wishing you an amazing day ahead!