Connect with us

Hi, what are you looking for?


Malware & Threats

Stealthy ‘LabRat’ Campaign Abuses TryCloudflare to Hide Infrastructure

The ‘LabRat’ cryptomining and proxyjacking operation relies on signature-based tools and stealthy cross-platform malware, and abuses TryCloudflare to hide its C&Cs.

A newly discovered financially motivated operation is relying on signature-based tools and stealthy cross-platform malware to remain undetected, and abuses TryCloudflare to hide its command-and-control (C&C) infrastructure, cloud security company Sysdig reports.

Dubbed LabRat and focused on cryptomining and proxyjacking, the campaign was seen relying on binaries written in Go and .NET, kernel-based rootkits, and C&C tools to bypass firewalls.

The attackers exploited CVE-2021-22205, a critical-severity vulnerability impacting GitLab Community Edition (CE) and Enterprise Edition (EE) versions 11.9 to 13.10.3, 13.9.6, and 13.8.8. Patched in April 2021, the vulnerability has a CVSS score of 10.

The bug leads to unauthenticated remote code execution and, as part of this campaign, the attackers exploited it to deploy a script to achieve persistence, kill specific processes to evade defenses, download additional binaries, and perform lateral movement by harvesting SSH keys.

To obfuscate their infrastructure, the attackers created subdomains Cloudflare’s TryCloudflare service. For that, they only needed to download and install Cloudflared, and run a specific command.

Through TryCloudflare, the attackers redirected connections to a password-protected server hosting the initial script, generating a new subdomain for each iteration of the script.

As part of the observed activity, the attackers linked directly to a private GitLab repository hosting various binaries, including some uploaded there very recently and not yet detected by antivirus services.

Advertisement. Scroll to continue reading.

Sysdig also discovered a variation of the attack, where a Solr server was used instead of TryCloudflare. Pointing to a legitimate webpage, the server was likely compromised by the attackers and abused as part of the operation.

The LabRat operators were also seen using the open source tool Global Socket (GSocket) – which offers a custom relay or proxy network, encryption, and connectivity over the Tor network – to obtain persistent access to the infected systems.

While investigating the repositories used in this campaign, Sysdig identified files related to a Russian proxyware service called ProxyLite[.]ru, as well as XMRig binaries connecting to various mining pools, including three that were not detected as malicious.

The cybersecurity firm also discovered evidence that, in previous attacks, the threat actor used a kernel-based rootkit to hide the cryptomining process, but which also provided full control over the infected systems.

“The stealthy and evasive techniques and tools used in this operation make defense and detection more challenging. Since the goal of the LabRat operation is financial, time is money. The longer a compromise goes undetected, the more money the attacker makes and the more it will cost the victim,” Sysdig notes.

Related: New ‘Lobshot’ hVNC Malware Used by Russian Cybercriminals

Related: Takedown of GitHub Repositories Disrupts RedLine Malware Operations

Related: New ‘Domino’ Malware Linked to FIN7 Group, Ex-Conti Members

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.


The recent ransomware attack targeting Rackspace was conducted by a cybercrime group named Play using a new exploitation method, the cloud company revealed this...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Malware & Threats

A vulnerability affecting IBM’s Aspera Faspex file transfer solution, tracked as CVE-2022-47986, has been exploited in attacks.