cyber.hendryadrian.com
Threat Research · hunt.io

Russian-Speaking Actor Uses Cloudflare Phishing Pages to Deliver Pyramid C2 Malware

· Original article ↗

Summary

Researchers detail a phishing campaign using Cloudflare Pages and Workers, search-ms links, and disguised LNK files to install malware. The infection reports victims’ IP addresses through Telegram and establishes persistence while communicating with Pyramid C2.

Key points

  • The campaign uses Cloudflare-branded DMCA notices on more than 20 pages.dev and workers.dev domains to lure victims.
  • Clicking the lure triggers a search-ms link that opens File Explorer to a remote share and downloads an LNK disguised as a PDF.
  • The LNK launches a PowerShell loader that retrieves a ZIP containing Python components and a decoy PDF.
  • The malware sends the infected host’s external IP address to an attacker-controlled Telegram bot, then communicates with Pyramid C2.
  • A Python loader is copied to the Windows startup folder for persistence; its C2 configuration adds five junk characters before decoding.
  • Researchers identified an exposed open directory and published infrastructure and file hashes as indicators of compromise.

Article Details

Attack Vectors
  • Cloudflare Pages and Workers pages impersonated secure document sharing and DMCA takedown notices to lure victims into downloading a malicious LNK file disguised as a PDF.
  • The phishing page used a Cloudflare Workers subdomain to return a search-ms: link that accessed a remote share and launched the LNK while a decoy PDF opened.
  • The LNK executed a PowerShell script that downloaded a ZIP archive containing a Python loader and legitimate python.exe; a shortcut to the loader was copied to the Windows startup folder.
  • The PowerShell script sent the infected host's external IP address to an attacker-operated Telegram bot. The Python loader communicated with Pyramid C2.
Defensive Notes
  • Monitor or restrict the search-ms: protocol handler and investigate its use to retrieve remote files.
  • Track open directories that serve staged payloads and monitor for LNK files disguised with document double extensions.
  • Monitor for PowerShell downloading ZIP archives, Python loaders launched from extracted archives, and shortcuts created in the Windows startup folder.
  • Monitor for attacker use of Telegram Bot API and Cloudflare Workers as part of early-stage activity.

Indicators of compromise

TypeIndicatorContext
DOMAIN3dflow-85wo[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAIN3dlinker-gs9y[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAIN3dmeshhub-k35m[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINcloud3d-k5sa[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINcloudforge-g9gi[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINcloudforge-p9cm[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINdevcloud-5lpl[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINdevcloud-63gg[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINdevcore-2lef[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINdevcore-ec8q[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINdevgrid-1wsz[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINdevgrid-72kx[.]pages[.]devCloudflare phishing page whose source was examined in the article.
DOMAINdevhub-dn06[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINdmca-hub-r2ao[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINidufgljr[.]procansopa1987[.]workers[.]devAttacker-used Cloudflare Workers subdomain that returned the search-ms link.
DOMAINmeshlinker-2imf[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINpolybase-6e8v[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINrenderbase-27s7[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINrenderbase-tp71[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINrenderhub-30pd[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINrenderhub-5bam[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINrendernest-54x9[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINrendernest-en88[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
DOMAINrendernest-y4et[.]pages[.]devCloudflare Pages domain identified among the campaign's phishing pages.
IPV4104[.]245[.]241[.]157Open directory serving files used in the actor's delivery infrastructure.
IPV4104[.]245[.]241[.]71Pyramid C2 server identified in the IOC table.
IPV4212[.]87[.]222[.]84Pyramid C2 server listed in the loader configuration.
IPV4213[.]209[.]150[.]191Server used in the search-ms link to host malicious files.
SHA2563b45369da19e3c30e0baf15b3499d119cf812a0e6c2b37b64620340b27decbe3SHA-256 hash listed for the campaign artifact KursorResources.lnk.
SHA2569103211fc44a4918591106e8bfa73c3d3cc1fa98512fa31aa87423f7a7c51825SHA-256 hash listed for terms-of-service.pdf.lnk, an artifact in the campaign's host IOC list.
SHA256b542033864dd09b2cff6ddec7f19ac480ab79e742481a14ae345051d323f58e7SHA-256 hash listed for the malicious PowerShell loader kozlina2.ps1.
SHA256be35ed6d513f06c1016a769ea6db7ee30a93b9a28ba39ecde832273833dc5b51SHA-256 hash listed for the Python loader kursor.py.
SHA256bf3b19c30085a9611650aa283856bf3defec894aae0b303ccf90244746127206SHA-256 hash listed for the malicious LNK file references.pdf.lnk.
SHA256d9afee5fc0039d6428ca7bc8d5e309cafdcd905b8e4d8843e6d21a89e2b25630SHA-256 hash listed for the campaign archive KursorResources.zip.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe loader prepended five junk characters to the encoded and compressed C2 configuration before stripping them for decoding.T1036.007 · Double File ExtensionThe malicious LNK used a double extension to masquerade as a PDF.T1041 · Exfiltration Over C2 ChannelThe PowerShell script sent the infected host's external IP address to the actor through a Telegram bot.T1059.001 · PowerShellThe LNK launched a PowerShell script that downloaded the next-stage files.T1105 · Ingress Tool TransferThe PowerShell loader downloaded a decoy PDF and ZIP archive containing the Python loader and dependencies.T1204.002 · Malicious FileVictims were lured into launching an LNK file disguised as a PDF.T1547.009 · Shortcut ModificationThe loader created a shortcut to the Python script and copied it to the Windows startup folder for persistence.

Vendors

Cloudflarewave of attacks attributed to the same Russian-speaking threat actor. This recent campaign leverages Cloudflare-branded phishing pages themed around DMCA (Digital Millennium Copyright Act) takedown notices served

Products

Microsoft Windows"A Windows Explorer window will appear shortly. Click 'Open' and wait for the file to be retrieved from our secure server. Please wait, your document is being prepared. This will take no more than 30 seconds. This is aPowerShellbegins with a Windows shortcut (.lnk) file masquerading as a PDF. When launched, the LNK executes a PowerShell script to download a ZIP archive from the actor's malicious infrastructure. The archive contains aPythonto download a ZIP archive from the actor's malicious infrastructure. The archive contains a legitimate python.exe binary alongside a malicious Python script, which is executed to establish communication with PyramidTelegramas a PDF via a double extension. Once executed, the malware checks in with an attacker-operated Telegram bot-sending the victim's IP address-before transitioning to Pyramid C2 to control the infected host.

Tools

CyberChefconfiguration was base64-encoded and zlib-compressed, making decoding straightforward with tools like CyberChef.Hunt.io AttackCapture

Related Articles