FlagThis

The Russian state-sponsored APT group, BlueAlpha, is employing sophisticated techniques to deliver custom malware, including GammaDrop and GammaLoad. They leverage Cloudflare Tunnels to mask their malicious activity, making detection and disruption more difficult. This abuse of legitimate infrastructure involves spearphishing campaigns with malicious HTML attachments that bypass email security measures. The malware, delivered through HTML smuggling and advanced techniques, allows for credential theft, data exfiltration, and persistent backdoor access to compromised networks.

BlueAlpha's use of Cloudflare's TryCloudflare tool, a free tunneling service, allows them to create random subdomains, routing traffic through the Cloudflare network and concealing their staging infrastructure. Further complicating detection, they utilize DNS fast-fluxing to hinder tracking and disruption of command-and-control (C2) communications. The group's advanced HTML smuggling techniques, including embedding malicious JavaScript within HTML attachments and exploiting the onerror HTML event to trigger malicious code execution, demonstrate a high level of sophistication and pose a significant security threat. This highlights the increasing trend of threat actors using legitimate services for malicious purposes.

ImgSrc: securityonline.info

References:

• @patrickcmiller.bsky.social - News report on Russian hackers abusing Cloudflare's service to drop GammaDrop malware. - 18d
• Cyber Security News - Article detailing BlueAlpha's use of Cloudflare Tunnels for malware delivery. - 18d
• GBHackers Security - Analysis of BlueAlpha's tactics, including use of Cloudflare Tunnels and DNS fast-fluxing. - 18d
• Malware Archives - News about BlueAlpha exploiting Cloudflare Tunnels for GammaDrop malware infrastructure. - 18d
• News - Report about Russian hackers abusing Cloudflare tunneling service to deploy GammaDrop malware. - 18d
• SOC Prime Blog - BlueAlpha Attack Detection: russia-affiliated Hacking Collective Abuses Cloudflare Tunnels to Distribute GammaDrop Malware - 18d
• Malware Analysis, News and Indicators - BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure - 18d
• The Hacker News - Hackers Leveraging Cloudflare Tunnels, DNS Fast-Flux to Hide GammaDrop Malware - 17d
• @infosecnews.bsky.social - Details on BlueAlpha's use of Cloudflare Tunnels to hide GammaDrop malware in phishing attacks. - 17d
• www.cysecurity.news - Hackers Exploit Cloudflare Tunnels and DNS Fast-Flux to Conceal GammaDrop Malware - 16d

Classification:

• HashTags: APT Malware Cloudflare
• Company: Cloudflare
• Target: Ukrainian organizations
• Attacker: BlueAlpha
• Product: Cloudflare Tunnels
• Feature: Tunneling
• Type: Malware
• Severity: Medium