Gamaredon C2 via Cloudflare Tunnels, Workers, and Dev Tunnels by Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

This rule detects network connections or DNS queries to known public tunneling services (e.g., Cloudflare Tunnel, localtunnel, bore, devtunnels) made by processes other than common web browsers. Attackers frequently use these services to bypass firewalls and establish unauthorized reverse shells or persistent C2 channels.