BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure

BlueAlpha, an FSB-directed APT active since at least 2014, has been delivering custom malware (GammaDrop dropper and GammaLoad loader) against Ukrainian organizations; the group now abuses Cloudflare Tunnels (trycloudflare.com subdomains) and HTML smuggling to stage and deliver payloads while using DNS fast-flux and heavy obfuscation to evade detection, enabling credential theft, data exfiltration, and persistent access—organizations are advised to harden email defenses, restrict risky execution paths (e.g., mshta.exe), monitor trycloudflare subdomains and DoH traffic, and apply threat intelligence countermeasures.