“TryCloudflare” Abuse: AsyncRAT Exploits Free Tunnels to Build Stealthy WebDAV Network

According to Trend Micro, a sophisticated campaign distributing the AsyncRAT Remote Access Trojan is abusing Cloudflare’s free-tier services and TryCloudflare tunneling domains to host malicious WebDAV servers, effectively hiding command-and-control infrastructure behind a veneer of legitimacy. The attack chain starts with phishing emails containing Dropbox links to a malicious archive named to resemble an invoice, where a double-extension trick leads to a WebDAV resource hosted on Cloudflare’s free services.

The downloaded archive opens a legitimate-looking PDF to lower suspicion, but actually triggers a multi-stage infection that includes downloading a valid, signed Python environment from python[.]org, observed as version 3.14.0, to run scripts. The ne.py payload is injected into explorer.exe, and batch files named ahke.bat and olsm.bat are placed in the user’s Startup folder to ensure re-execution on reboot.

The report highlights this as part of a broader shift towards abusing legitimate services to deliver malware and maintain footholds, a trend underscored as a living-off-the-land activity.