cybersecurity

Threat Actors Increasingly Abuse Cloudflare Quick Tunnels for Malware Distribution and Post-Compromise Operations

Cybersecurity Services by SpearTipNewsAugust 25, 2026

SpearTip’s Managed Security Operations Center has observed threat actors increasingly leveraging Cloudflare Quick Tunnels (*.trycloudflare.com) as temporary infrastructure supporting malware distribution, payload staging, persistence, and post-compromise operations.

Share this

Across multiple investigations, SpearTip identified unique Quick Tunnel subdomains being used to host malware repositories, distribute attacker tooling, expose upload functionality, and support operational workflows following compromise.

Observed activity included:

  • Malware hosting and payload delivery
  • Unauthorized account creation
  • Registry-based persistence
  • Microsoft Defender evasion
  • Remote Desktop enablement
  • Remote access tooling deployment
  • File upload and collection infrastructure

The repeated use of Cloudflare Quick Tunnel infrastructure across separate investigations suggests that abuse of *.trycloudflare.com is becoming an increasingly common component of attacker tradecraft. 

Cloudflare Quick Tunnels as Adversary Infrastructure

Cloudflare Quick Tunnels provide a legitimate mechanism for exposing locally hosted applications to the Internet without requiring public IP addresses, firewall modifications, or traditional hosting infrastructure.

During multiple investigations, SpearTip observed threat actors leveraging this capability to rapidly deploy temporary infrastructure supporting malicious operations. Unlike traditional attacker infrastructure that often relies on registered domains or virtual private servers, Quick Tunnels can be created within minutes and rotated frequently, making them attractive for short-lived campaigns and post-compromise activity.

One recurring characteristic observed across investigations was the use of publicly accessible Quick Tunnel endpoints hosting malware repositories, payload staging locations, and upload functionality. In several cases, the infrastructure appeared to support multiple phases of attacker operations, including payload delivery, tooling distribution, persistence activities, and data collection.

The ability to rapidly provision and replace infrastructure, combined with the trusted reputation of Cloudflare services, provides threat actors with a flexible platform that can complicate traditional reputation-based detection and blocking strategies.

Infrastructure Observed Across Multiple Investigations

During multiple investigations, SpearTip identified the following Quick Tunnel subdomains associated with malicious activity:

  • lol-afford-write-zealand.trycloudflare.com
  • fair-reaction-clips-pupils.trycloudflare.com
  • core-rules-reflection-yield.trycloudflare.co
  • medication-ours-contractors-rob.trycloudflare.com
  • earlier-based-depth-entertaining.trycloudflare.com
  • installations-desire-downloading-don.trycloudflare.com
  • looked-partners-program-broadway.trycloudflare.com
  • trivia-cancelled-supplements-speeches.trycloudflare.com

Several of these domains exposed payload repositories, download locations, and upload functionality that supported attacker operations across multiple investigations. One observed repository exposed a publicly accessible /static/ directory hosting payloads including:

  • 1.1
  • 2.2
  • 3.3
  • Http.exe
  • Rdp.exe

Additional infrastructure exposed upload functionality and hosted attacker-controlled content used during post-compromise activity.

The use of multiple independently generated subdomains across separate investigations suggests that actors are leveraging Quick Tunnel infrastructure as a disposable operational resource rather than relying on long-term infrastructure.

Case Study: Quick Tunnel Infrastructure Supporting Post-Compromise Activity

During one SpearTip SOC investigation, Cloudflare Quick Tunnel infrastructure was observed supporting a full post-compromise attack chain. The threat actor primarily leveraged a compromised domain account and subsequently:

  • Created unauthorized local accounts:
    • Administrator
    • TntUser
  • Modified registry settings to hide attacker-created accounts from the Windows logon interface.
  • Created Microsoft Defender exclusions to reduce endpoint visibility.
  • Downloaded multiple payloads from Quick Tunnel infrastructure.
  • Attempted to enable Remote Desktop access.
  • Created firewall rules to facilitate remote access.
  • Deployed additional tooling to maintain access.

Persistence Activity

The investigation identified modifications to:

  • HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
  • Observed values included:
    • Administrator = 0
    • TntUser = 0

These modifications allowed attacker-created accounts to remain active while being hidden from the Windows logon interface.

Defense Evasion Activity

The threat actor created Microsoft Defender exclusions including:

  • C:\ProgramData
  • C:\Windows\Temp\ngrok.exe
  • ngrok.exe
  • .exe

The investigation also identified attempts to weaken endpoint protections through additional registry and PowerShell-based configuration changes.

Payloads and Tooling Observed

Files identified during the investigation included:

  • C:\ProgramData\1.1
  • C:\ProgramData\2.2
  • C:\ProgramData\3.3
  • C:\ProgramData\Http.exe
  • C:\ProgramData\Rdp.exe
  • C:\Windows\Temp\update.exe
  • C:\Users\Public\All.bat
  • C:\Users\Public\vcruntime140.dll
  • C:\Users\Public\PingCaler.exe
  • C:\Users\Public\Zero.ux.tmp

The recovered batch file contained commands designed to:

  • Create local administrator accounts
  • Hide accounts from the Windows logon interface
  • Create Microsoft Defender exclusions
  • Attempt to disable Microsoft Defender
  • Enable Remote Desktop
  • Create inbound RDP firewall rules
  • Configure TCP port 3389
  • Reference ngrok-related functionality

Authentication Activity

The investigation also identified credential-related activity involving PingCaler.exe.

Observed telemetry included:

  • Windows Event ID 4624
  • Logon Type 9 (NewCredentials)
  • Process: C:\Users\Public\PingCaler.exe

This activity indicates the tool created an alternate authentication context while operating under a compromised domain account, suggesting support for outbound authentication or credentialed operations.

Indicators of Compromise (IOCs)

Domains

  • lol-afford-write-zealand.trycloudflare.com
  • fair-reaction-clips-pupils.trycloudflare.com
  • core-rules-reflection-yield.trycloudflare.com
  • earlier-based-depth-entertaining.trycloudflare.com
  • installations-desire-downloading-don.trycloudflare.com
  • looked-partners-program-broadway.trycloudflare.com
  • medication-ours-contractors-rob.trycloudflare.com
  • trivia-cancelled-supplements-speeches.trycloudflare.com

URLs

  • http://lol-afford-write-zealand.trycloudflare.com/static/
  • https://fair-reaction-clips-pupils.trycloudflare.com/upload/
  • https://fair-reaction-clips-pupils.trycloudflare.com/4QUSant.che

Files

  • C:\Users\Public\PingCaler.exe
  • C:\Users\Public\All.bat
  • C:\Users\Public\vcruntime140.dll
  • C:\Users\Public\Zero.ux.tmp
  • C:\ProgramData\1.1
  • C:\ProgramData\2.2
  • C:\ProgramData\3.3
  • C:\ProgramData\Http.exe
  • C:\ProgramData\Rdp.exe
  • C:\Windows\Temp\update.exe

Accounts

  • Administrator
  • TntUser

Registry Locations

  • HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
  • HKLM\SOFTWARE\Policies\Microsoft\Microsoft Defender
  • HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
  • HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Infrastructure / IPs

  • 104.16.230.132
  • 104.16.231.132
  • 62.138.7.161

Investigation and Remediation Guidance

SpearTip recommends organizations:

  • Monitor and investigate outbound connections to *.trycloudflare.com.
  • Review DNS, proxy, firewall, and EDR telemetry for Quick Tunnel activity.
  • Alert on PowerShell, certutil, curl, and other download activity involving Quick Tunnel domains.
  • Monitor application servers for child process execution originating from web services.
  • Review systems for unauthorized account creation and persistence mechanisms.
  • Validate Microsoft Defender configurations for unauthorized exclusions.
  • Review Remote Desktop configuration changes and firewall rule modifications.
  • Incorporate the identified IOCs into enterprise-wide threat hunting efforts.
  • Where business requirements permit, block *.trycloudflare.com at the firewall, DNS filtering, secure web gateway, or proxy layer.
  • Investigate communications involving 62.138.7.161 when observed alongside payload downloads or related tooling activity.

Key Takeaway

Cloudflare Quick Tunnels are a legitimate service; however, SpearTip’s Managed Security Operations Center continues to observe abuse of *.trycloudflare.com infrastructure across multiple investigations. Threat actors are leveraging Quick Tunnel subdomains to host malware, stage payloads, distribute tooling, establish persistence, weaken security controls, and support post-compromise operations.

Organizations should treat unexpected Quick Tunnel activity as a high-fidelity indicator requiring investigation, particularly when observed alongside PowerShell, certutil, remote access activity, account creation events, or other post-compromise behaviors.

How SpearTip Helps

Threats do not operate on a business schedule, and neither do we. SpearTip's Managed Security Services provide 24/7 monitoring, detection, and response capabilities designed to identify suspicious activity before it becomes a business-impacting incident. Our Security Operations Center continuously investigates alerts, hunts for emerging threats, and monitors for indicators of compromise across your environment. Whether attackers are leveraging abused cloud services, compromised identities, or advanced malware, our analysts work around the clock to detect and contain threats on your behalf, helping your organization stay resilient in an increasingly complex threat landscape.

Need Assistance?

Sales: 800.236.6550 | info@speartip.com

Experiencing a Breach? Call 833.977.7327 or email ir@speartip.com for immediate response support.