Hackers Leveraging Cloudflare Tunnels, DNS Fast-Flux to Hide Gamma Drop Malware
Summary: Recorded Future's Insikt Group reports that Gamaredon, a Russia FSB-affiliated actor tracked as BlueAlpha and active since 2014, is using Cloudflare Tunnels to conceal the staging server that delivers GammaDrop, a HTA dropper that writes a loader called GammaLoad to disk. The campaign targets Ukrainian entities through spear-phishing emails with HTML attachments that use HTML smuggling to drop a 7-Zip archive containing a malicious LNK file, and GammaLoad resolves command-and-control through DNS-over-HTTPS providers like Google and Cloudflare plus DNS fast-fluxing.
Why it matters: The staging server sits behind a Cloudflare Tunnel on a trycloudflare.com domain and C2 lookups ride DNS-over-HTTPS, so the legitimate services your network already trusts are the ones carrying the malware - a detection gap Recorded Future says will keep widening for organizations with limited threat detection capabilities.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026