AsyncRAT Leveraging Cloudflare’s Free-Tier Services to Mask Malicious Activities and Detection

A multi-stage AsyncRAT campaign leverages Dropbox-hosted invoice-themed ZIPs containing deceptive .url shortcuts that connect to WebDAV resources on TryCloudflare/Cloudflare-backed domains. Stages include downloading batch and PowerShell scripts, installing an embedded Python 3.14 runtime into a user folder, creating Startup persistence (ahke.bat, olsm.bat) to run a Python loader (ne.py), and performing polymorphic APC-based code injection into explorer.exe using encrypted shellcode (new.bin) and keys (a.txt). Trend Micro telemetry links multiple TryCloudflare domains to the same backend and provides commands, filenames, and domains observed, highlighting how attackers blend into legitimate cloud traffic and official Python downloads to evade simple reputation-based defenses.