Executive Summary
RADICL identifies a two-stage malware operation tracked as UNC-RAID-M8280, utilizing a Rust-compiled loader to deliver modified Sliver C2 implants across five architectures including Windows and Linux. The campaign leverages misconfigured third-party cloud storage buckets for high-reputation hosting of stage-two payloads, which are encrypted using AES-128-CFB.
The second-stage Sliver implants represent a custom fork containing non-public protobuf extensions (FlyFire) for specialized tasking such as versioned self-upgrades and tool uploads. The threat actor further conceals their origin by routing command-and-control (C2) traffic through Cloudflare Tunnels, effectively masking their actual server infrastructure behind rotating edge addresses. This activity highlights a sophisticated, multi-platform approach aimed at defense and infrastructure sectors through supply-chain and cloud-service abuse.