SilverFox relays.json cache-busting fetch to Cloudflare Workers relay pool

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•2

Detects network activity associated with the SilverFox malware, specifically targeting the discovery of relay endpoints via specific URI patterns containing cache-busting timestamps, DNS lookups for identified relay domains (noah-ssh.com.cn) and Cloudflare Workers subdomains, and suspicious HTTP response characteristics such as specific cache headers paired with wildcard CORS headers.