BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure
By Insikt Group®
Excerpt
BlueAlpha continues to target
Ukrainian entities with
spearphishing campaigns,
leveraging HTML smuggling
attachments to deliver Visual Basic
Script (VBScript)-based malware.
BlueAlpha continues to use domain
name system (DNS) fast-fluxing
of GammaLoad command-and-
control (C2) infrastructure to
complicate tracking and disruption
of C2 communications.
CYBER
THREAT
ANALYSIS
RUSSIA
C…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Recorded Future on go.recordedfuture.com.
Mentioned in the excerpt
More from Recorded Future21
- BlueDelta Targets Defense and Diplomacy with HOOKEDGERecorded Future · Added 23 Sep
- Latin America and the Caribbean Cybercrime LandscapeRecorded Future · Added 4 Jun
- GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain AttackRecorded Future · Added 17 Apr
- DRAT V2: Updated DRAT Emerges in TAG-140’s ArsenalRecorded Future · Added 17 Aug 2025
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
