Gamaredon - Cloudflare Workers C2 Fallback Sequence (T1008)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•5

Detects a specific C2 fallback mechanism used by Gamaredon, where the malware fails to resolve Cloudflare and then shifts to making multiple network connections to .ru or .su domains within a short time frame (more than 3 connections per minute). The connections are initiated by 'wscript.exe' or 'mshta.exe'. This pattern indicates a potential attempt to establish communication with a fallback command and control server.