Gamaredon Cloudflare Tunnel and Workers C2 Channel via trycloudflare.com/workers.dev

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•3

Detects network traffic to Cloudflare-hosted services (trycloudflare.com, workers.dev) potentially indicative of C2 communication, especially when initiated by common scripting or proxy processes like powershell.exe, wscript.exe, cscript.exe, mshta.exe, or cloudflared.exe.