Gamaredon C2 Tunneling via Microsoft Dev Tunnels and Loophole Services

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•2

This rule detects DNS queries to known public tunneling service domains, such as devtunnels.ms, loophole.site, loca.lt, and bore.pub, originating from processes other than the legitimate developer tunneling tools (devtunnel.exe, code.exe, code-tunnel.exe). This activity is highly indicative of unauthorized remote access or command-and-control communication.