BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure

Recorded Future Insikt Group documents an ongoing BlueAlpha (Gamaredon-linked, FSB-associated) espionage campaign targeting Ukrainian-speaking organizations that uses XHTML/HTML smuggling to deliver VBScript-based GammaLoad via an HTA loader (GammaDrop). The campaign abuses free Cloudflare Tunnels (trycloudflare.com subdomains) to conceal staging infrastructure, employs DNS fast-flux and DoH for resilient C2, and includes deobfuscated code, indicators (domains, IP, hashes), MITRE ATT&CK mappings, and recommended mitigations.