Gamaredon Cloudflare Workers C2 Domain Fronting via .workers.dev Subdomains

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•5

Detects HTTP and DNS requests directed towards the .workers.dev domain, which are commonly leveraged by threat actors for command and control (C2) redirection and domain fronting. This activity is frequently associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's infrastructure.