GammaDrop - Date-Derived Cloudflare Workers C2 URL

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

This rule detects outbound HTTP connections to Cloudflare Workers URLs that match the dynamic, date-derived campaign folder parameters used by the GammaDrop malware. Specifically, it looks for URLs ending with a pattern like '/[A-Za-z0-9-]+/[a-z]+/[0-9]{2}.[0-9]{2}.[0-9]{3}/[0-9]+.(tif|bmp)'. This pattern is indicative of GammaDrop's command and control (C2) communication.