Detecting Multi-Stage Infection Chains Madness

This report details a multi-stage malware campaign (observed since Feb 2024) that leverages Cloudflare tunnel WebDAV hosting to distribute remote access trojans (notably AsyncRAT) via phishing (.ms-library attachments) and a complex LNK->HTA->BAT->Python->DLL execution chain; it includes detection guidance (Sigma/SOL rules), persistence and defense-evasion behaviors, and actionable IoCs (trycloudflare/duckdns domains and file hashes).