SilverFox Cloudflare Workers Backup Relay Node Access

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•3

Detects outbound network communication attempts by the SilverFox malware to known Cloudflare Workers relay infrastructure, specifically targeting hostnames associated with 'noah-relay' instances. The rule monitors DNS lookups, TLS SNI headers, and HTTP Host headers to identify potential Command and Control (C2) traffic.