QUICAgent Cloudflare Workers dead-drop resolver DNS lookup

Emiliano Mema@Nosalva

•updated Aug 27, 2026•0•0•1

Detects DNS queries to Cloudflare Workers subdomains that mimic the QUICAgent beaconing pattern. Adversaries utilize these workers as dead-drop resolvers to retrieve updated C2 instructions or redirection information, effectively blending in with legitimate traffic to the workers.dev domain.