Cloudflare Tunnel Abuse: C2 and Delivery Through a Trusted Edge

Cloudflare Tunnel is a legitimate service: the lightweight cloudflared agent creates an outbound-only, encrypted tunnel from a host to Cloudflare’s edge, exposing an internal service to the internet without inbound firewall rules or a public IP. TryCloudflare is the free, no-account variant that spins up an ephemeral, randomly named subdomain for a one-time tunnel. Two distinct abuse patterns are documented: ephemeral TryCloudflare tunnels for commodity malware delivery and C2 staging (Proofpoint, delivering AsyncRAT and XWorm), and named or persistent tunnels on compromised hosts for stealthy, resilient remote access and data theft (GuidePoint). Both exploit that the tunnel is outbound-only, TLS-encrypted and terminates on trusted Cloudflare infrastructure.

Pattern A: TryCloudflare Delivery

Proofpoint reported a financially motivated cluster, first observed in February 2024, abusing ephemeral TryCloudflare tunnels to deliver malware. The chain runs from a phishing email to a URL or internet-shortcut file, to a WebDAV share behind a TryCloudflare-proxied endpoint, to an LNK or VBS, to a command script, to PowerShell that downloads the final payload — families across waves include AsyncRAT, XWorm, VenomRAT, GuLoader, Remcos and PureLogs. The ephemeral tunnel needs no account and leaves a random *.trycloudflare.com hostname, defeating static domain blocklists. T1566.002 T1204.001 T1102

Pattern B: Persistent Named Tunnels

• Threat actors run cloudflared on compromised hosts for persistent, stealthy access and exfiltration; starting a named tunnel can require only a token on the command line, leaving little config on disk. T1572 T1090.002
• Persistence via scheduled task, Run key or a system service to relaunch the agent. T1053.005 T1543.003
• Masquerading: Medusa ransomware renamed cloudflared.exe to svchost.exe, and BlackSuit operators used names like WGUpdater.exe — so filename alone is not a reliable signal. T1036.005

Transport

MITRE ATT&CK Mapping

Detection & Mitigation

• Inventory and allowlist cloudflared; alert on any install or execution outside approved hosts, especially from user-writable paths, and detect masquerading by signature rather than filename.
• Monitor and, where feasible, restrict outbound port 7844 (UDP and TCP) from hosts that should not tunnel; hunt for *.trycloudflare.com in DNS and proxy logs.
• At the mail gateway, block and inspect .URL, .LNK and .vbs attachments and WebDAV retrievals, and disable the WebClient service where WebDAV is not required to break the shortcut-to-WebDAV step. Deploy published Sigma and Elastic detection rules for cloudflared tunnel execution.