Government Hit by Multi-Malware Cyberattack via Cloudflare Service

eSentire TRU uncovered a phishing-based campaign against government targets that used a TryCloudflare-proxied WebDAV server to distribute encrypted and highly obfuscated payloads (obfuscated .bat and Python files) which deployed XWorm, AsyncRAT, VenomRAT and PureLogs Stealer; the attack chain employed in-memory shellcode (Donut loader), direct syscalls and Early Bird APC injection to evade EDR and achieve persistence and data exfiltration.