Cloudflare Adds Edge-Based Malware Scanning to Gateway

Cloudflare is introducing malware detection and prevention directly at its edge, giving Gateway users a new layer of defense against malicious file downloads. The feature operates within Cloudflare's existing network infrastructure, which spans data centers in 200 cities, so security policies can be enforced without backhauling traffic to a central inspection point.

Gateway started as a DNS filtering service and has since expanded into a full Secure Web Gateway that inspects HTTP traffic. That progression already allowed administrators to block malicious URLs, unwanted file types, and specific applications commonly used to distribute malware, such as public cloud storage services. With the addition of antivirus scanning, Gateway now also inspects files as they pass through Cloudflare's edge.

Why a Layered Approach Matters

Malware can disrupt business operations through ransomware, exfiltrate sensitive data via spyware, or hijack local CPU resources for cryptojacking. While email remains a common distribution channel, attackers are increasingly using other communication paths, including SMS, voice, and support ticket software, to evade email-focused defenses.

Because no single tool can catch every threat, Gateway is designed as a defense-in-depth solution. DNS filtering blocks threats that abuse the DNS protocol for command-and-control communication or data exfiltration, and it applies to all applications generating DNS queries. HTTP inspection adds depth, catching threats users encounter while browsing. File scanning provides another checkpoint, with the goal of stopping malicious files before they reach corporate devices.

How File Scanning Works

When a user initiates a download, the file is routed through the nearest Cloudflare data center and forwarded to a malware scanning engine. The engine contains malware sample definitions that are updated daily. If the scanner detects malware, Gateway resets the connection, which appears to the user as a download error in their browser.

The platform is managed entirely by Cloudflare, so administrators do not need to purchase separate antivirus licenses or keep virus definitions current. Gateway logs the URL where the file was downloaded, the SHA-256 hash of the file, and a record that the file was blocked due to malware. These centralized logs give administrators visibility into the source of an attack and the resources affected, supporting incident response and remediation.

Detection During a Multi-Stage Attack

Even with strong prevention, security teams often operate under an "assume breach" model, acknowledging that unknown threats can slip through. Gateway's logging is built to surface actionable insights for these scenarios, including more sophisticated attack patterns:

  • After a system is exploited, a stage 0 implant or dropper is placed on the device.
  • The dropper sends a DNS query to a C2 domain that threat research has not yet flagged.
  • The C2 response encodes information about where the implant can download additional components.
  • DNS tunneling to a second, unknown malicious domain delivers the remaining pieces of the implant.
  • The fully assembled implant carries out tasks from another C2 server, such as file exfiltration, lateral movement, encryption, or cryptocurrency mining.

Gateway detects more than just queries to known malicious domains. It uses heuristics from threat research to identify queries that look like they were generated by a Domain Generation Algorithm (DGA), catching previously unknown threats from log data and blocking them proactively. Cloudflare also applies insights derived from its network-wide view to keep Gateway's protections current without requiring manual intervention from IT administrators.

Availability and Pricing

DNS tunneling and DGA detection are included in Gateway DNS filtering at no cost for teams of up to 50 users. The new in-line malware detection at Cloudflare's edge is included with Teams Standard and Teams Enterprise plans. Cloudflare says filtering at the network level and integration with GRE tunnels are in development.