Russia's 'BlueAlpha' APT Hides in Cloudflare Tunnels

Recorded Future’s Insikt Group reports that the Russian state-sponsored APT BlueAlpha is abusing Cloudflare Tunnels (TryCloudflare subdomains) to hide staging infrastructure and deliver its proprietary GammaDrop malware using HTML smuggling and DNS fast-flux; GammaDrop enables data exfiltration, credential theft, and backdoor access, and the group has targeted Ukrainian organizations with spearphishing and custom VBScript malware (GammaLoad). Insikt recommends strengthening email defenses against HTML smuggling, flagging suspicious HTML attachments and trycloudflare.com requests, and blocking misuse of mshta.exe and untrusted .lnk files.