Gamaredon PteroPaste Cloudflare Workers/Tunnel Dead-Drop C2 Polling by Script Hosts

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•5

Detects suspected command and control (C2) activity leveraging Cloudflare Tunnel or Workers. The rule identifies two patterns: 1) Repeated polling (>5 connections in 10 minutes) to Cloudflare infrastructure by suspicious scripting processes (e.g., PowerShell, WScript), and 2) A 'dead-drop' resolver pattern where a process contacts a Cloudflare domain, followed by a DNS query to an unrelated domain shortly thereafter, suggesting the retrieval of a new C2 address.