Hackers Abuse Cloudflare Storage to Exfiltrate Network Files

A targeted cyber-espionage campaign against Malaysian organisations leveraged an Azure VM to host attacker tooling (custom Python scripts, Laravel exploit chains, a C# beacon and Python C2 listener, and a PHP webshell), used Cloudflare-hosted storage for stealthy exfiltration, and achieved at least one full domain compromise with exfiltrated SAM/NTDS/registry hives—enabling credential harvesting, lateral movement, and persistent access; organizations should remove webshells, rotate domain credentials, and perform deep forensics.