BlackWater Malware Abuses Cloudflare Workers for C2 Communication

guest · Mar 14, 2020

BlackWater Malware Abuses Cloudflare Workers for C2 Communication
March 14, 2020
https://www.bleepingcomputer.com/ne...uses-cloudflare-workers-for-c2-communication/

A new backdoor malware called BlackWater pretending to be COVID-19 information while abusing Cloudflare Workers as an interface to the malware's command and control (C2) server.
BlackWater uses Cloudflare Workers as a C2 interface
Recently MalwareHunterTeam discovered a RAR file being distributed pretending to be information about the Coronavirus (COVID-19) called "Important - COVID-19.rar".
The opened document is a document containing information on the COVID-19 virus and is being used by the malware as a decoy as it installs the rest of the malware and executes it on the computer.

This is where things get a bit interesting as the malware is then launched using a command line that causes the BlackWater malware to connect to a Cloudflare Worker that acts as a command and control server or at least a passthrough to one.
Click to expand...

When we asked why they were using a Cloudflare Worker rather than connecting directly to the C2, Kremez felt it was to make it harder to for security software to block IP traffic without blocking all of Cloudflare's Worker infrastructure.
Using Cloud Workers, traffic to malware command & control servers become harder to block and the malware operation can be easily scaled as needed.
Click to expand...

Log in or Sign up

BlackWater Malware Abuses Cloudflare Workers for C2 Communication

guest Guest

Log in or Sign up

BlackWater Malware Abuses Cloudflare Workers for C2 Communication

guest Guest

Useful Searches