Hackers Abuse Cloudflare Storage to Exfiltrate Network Files

A sophisticated cyber espionage campaign targeting multiple Malaysian organizations has been uncovered, revealing a highly structured attack chain that blends custom tooling, cloud infrastructure, and stealthy data exfiltration.

At the center of the operation is an Azure virtual machine (IP: 20.17.161.118) used to orchestrate attacks across government-linked networks.

The infrastructure contained a wide range of attacker tools, including tailored Python scripts, Laravel exploit chains, webshell deployment utilities, and even source code for previously undisclosed command-and-control (C2) components.

The attackers demonstrated strong operational discipline by developing purpose-built Python scripts for each target and function. These tools handled internal network enumeration, database access, and data staging before exfiltration.

For example, scripts such as analyze_[REDACTED].py leveraged administrator-level WinRM access and embedded MSSQL credentials to run PowerShell queries directly against internal databases.

Security researchers at Oasis Security identified attacker-controlled infrastructure hosted on Microsoft Azure in the Malaysia West region, signaling a deliberate effort to operate close to targeted environments while minimizing detection.

Others, like asset_owner_check.py, prepared sensitive datasets by validating integrity and compressing files for extraction. Additional scripts targeted specific data types, including photo records stored in databases.

A separate toolkit was designed for external-facing government portals. One script exploited an exposed RPC.

ASP endpoint to execute remote Windows commands via HTTP POST requests, enabling attackers to run code without direct system interaction.

The use of a password list containing 126 targeted credentials further highlights the precision of the campaign.

Hackers Abuse Cloudflare Storage

A notable aspect of this intrusion is the use of Cloudflare-hosted storage for data exfiltration. The script gen_photo_upload.py was specifically designed to upload stolen files from compromised systems to attacker-controlled Cloudflare endpoints.

One of the scripts, h[REDACTED]_alt_creds.py, interacts with an exposed rpc.asp endpoint to execute remote Windows commands via WScript.Shell object creation.

This approach provides multiple advantages:

• Blends malicious traffic with legitimate cloud services.
• Reduces the likelihood of detection by traditional security tools.
• Enables reliable and scalable data transfer خارج the victim network.

In parallel, a separate script (deploy.py) enabled remote command execution via external RPC endpoints, allowing attackers to maintain control without persistent interactive sessions.

The campaign escalated to full domain compromise in at least one case. Researchers discovered exfiltrated Windows registry hive files (SAM, SECURITY, SYSTEM) and NTDS dumps from a domain controller.

These artifacts allow attackers to extract password hashes and sensitive credentials offline using tools like Mimikatz.

This level of access enables:

• Long-term persistence across the network.
• Lateral movement between systems.
• Potential re-entry even after partial remediation.

Additionally, attackers deployed a PHP webshell (health.php) on a government-associated server, which remained active at the time of analysis, providing ongoing remote access.

The attackers also exploited a Malaysian mobile operator’s platform using a chained Laravel remote code execution technique.

The exploit combined five deserialization gadget chains, using encrypted payloads compatible with Laravel’s framework to execute system commands.

Beyond exploitation, researchers uncovered source code for a private C2 framework, including:

• A C# beacon (beacon.cs) used for persistence and communication.
• A Python-based HTTP listener (listener_http.py) to manage infected hosts.

These tools are not publicly available, indicating a well-resourced threat actor operating beyond typical commodity malware campaigns.

This campaign stands out due to its structured, modular design and reliance on custom-built tooling.

The confirmed extraction of Active Directory credentials, use of cloud services for stealthy exfiltration, and presence of active webshells indicate a mature and persistent threat.

Organizations facing similar threats should prioritize immediate containment actions, including removing webshells, rotating domain credentials, and conducting deep forensic analysis to identify lingering attacker access.

The combination of Azure-hosted infrastructure, Cloudflare-based exfiltration, and private C2 tooling highlights an evolving threat landscape where attackers increasingly blend into trusted cloud ecosystems to evade detection.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.