Cyberkriminelle nutzen Cloudflare-Speicher-Endpunkt zum Diebstahl von Dateien aus kompromittierten Netzwerken

Attackers have found a new way to quietly steal data from compromised networks, and this time, they are hiding behind a familiar face. Security researchers have uncovered a targeted intrusion campaign that used a Cloudflare-hosted storage endpoint to pull stolen files out of breached systems without raising alarms.

The operation targeted multiple Malaysian government organizations and at least one private sector company, showing planning that goes well beyond what most opportunistic hackers typically demonstrate. What makes this campaign stand out is the sophistication behind it. The attacker did not rely on off-the-shelf tools.

Instead, they built custom Python scripts tailored to each individual target, with each tool designed for a specific task inside the compromised environment. That kind of groundwork takes real skill and points to a threat actor who takes operational discipline seriously. Analysts from OASIS Security said in a report shared with