Shadowv2 Cloudflare UAM Bypass Activity

Tim Peck@timpeck

•updated Sep 23, 2025•0•88

Detects potential Cloudflare Under Attack Mode (UAM) bypass activity, characteristic of the ShadowV2 botnet. This involves the execution of a headless browser followed by network requests using a Cloudflare clearance cookie.