Cloudflare R2 Storage Vulnerability Lets Attackers Exfiltrate Files

Key Takeaways

• A sophisticated threat actor has been observed using Cloudflare R2 storage endpoints as a covert channel for data exfiltration.
• The campaign, which targeted Malaysian government entities and a private company, employed custom-built Python scripts and previously undisclosed C2 tools.
• Attackers successfully stole domain controller credentials, deployed webshells, and exploited a mobile network operator’s platform.
• The technique “living off trusted services” allows exfiltration traffic to blend with legitimate cloud activity, making detection challenging.

Cybersecurity researchers have uncovered an advanced persistent threat (APT) campaign utilizing Cloudflare Storage Endpoints to surreptitiously extract sensitive files from compromised networks. This method enables attackers to blend their malicious outbound traffic with legitimate cloud services, thereby evading detection by conventional security measures.

The operation, detailed in a report by OASIS Security, focused on multiple Malaysian government organizations and at least one private sector entity. The meticulous planning and execution observed in this campaign indicate a highly skilled threat actor operating with significant resources, far exceeding the capabilities of typical opportunistic attackers.

Analysts gained critical insights into the attacker’s methodology after discovering a Microsoft Azure virtual machine in the Malaysia West region (IP Address: 20.17.161.118) that served as the command and control (C2) and staging infrastructure. This infrastructure contained a trove of uncleaned attack tools, offering a clear window into the adversary’s operations.

The comprehensive campaign involved various stages, including gaining database access, mapping internal networks, deploying persistent webshells, and stealing credentials. The linchpin of their strategy was the use of a Cloudflare storage endpoint as the ultimate destination for stolen data, a technique designed to camouflage exfiltration within normal cloud traffic.

The consequences of these intrusions have been severe, with confirmed theft of domain controller credentials, active webshells found on government servers, and a sophisticated chained exploit targeting a mobile network operator’s customer verification platform. These findings underscore the capabilities of a well-resourced actor methodically targeting multiple high-value organizations simultaneously.

Attackers Leverage Cloudflare Storage for Exfiltration

A particularly innovative aspect of this campaign was the attacker’s method for moving stolen data out of breached environments. A custom Python script, named gen_photo_upload.py, was specifically developed to upload exfiltrated files to an attacker-controlled, Cloudflare-hosted storage endpoint.

Given Cloudflare’s widespread reputation as a trusted internet service provider, network traffic directed to its infrastructure often bypasses the scrutiny applied to connections with unknown or suspicious servers. This tactic, known as “living off trusted services,” is increasingly favored by advanced threat actors seeking to minimize their digital footprint and prolong their dwell time within compromised networks.

By channeling stolen data through a legitimate cloud provider, the attackers effectively disguised outbound exfiltration as routine web activity. Organizations that lack robust outbound traffic inspection capabilities for trusted domains are particularly vulnerable to this technique, as it can allow data theft to proceed undetected for extended periods.

The gen_photo_upload.py script was an integral component of a larger, modular toolkit. Each script within this collection was engineered for a distinct purpose, creating a structured attack pipeline from initial compromise to final data exfiltration. The modular design enabled the attackers to tailor their operations precisely to each target environment.

Custom C2 Tools and Credential Theft

Among the most concerning discoveries was the presence of previously unpublished source code for a C# beacon generator (beacon.cs) and a Python-based command and control controller (listener_http.py). These custom tools are not derived from any publicly available frameworks, signaling that this actor operates at a level significantly above that of typical commodity attackers.

The C# beacon establishes a private communication channel with the Python listener, facilitating command execution and data exchange between the attacker and compromised hosts. Its existence within the attacker’s infrastructure suggests its deployment in multiple prior operations. Developing and maintaining such a bespoke framework demands considerable expertise and sustained resources.

Regarding credential theft, the attackers successfully extracted Windows registry hive files (SAM, SECURITY, and SYSTEM) from at least one domain controller. Furthermore, an NTDS dump confirmed the exfiltration of Active Directory password hashes. With these critical credentials, the threat actor possesses the means for persistent and extensive access across the entire affected network infrastructure.

What You Should Do

• Immediately identify and remove all active webshells from compromised servers.
• Reset all domain-level passwords, including those for service accounts and administrators.
• Conduct a thorough forensic analysis to identify and eliminate any attacker-left artifacts or backdoors that could facilitate future access.
• Implement robust outbound traffic inspection, even for trusted cloud services, to detect anomalous data flows.
• Review and strengthen Active Directory security, including implementing multi-factor authentication (MFA) for all administrative accounts and regularly auditing domain controller logs.
• Consider deploying Endpoint Detection and Response (EDR) solutions to monitor for suspicious script execution and file exfiltration attempts.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.