# ET MALWARE Gamaredon.APT TryCloudFlare Activity

**URL:** <https://community.emergingthreats.net/t/et-malware-gamaredon-apt-trycloudflare-activity/2327>\
**Category:** Rule Signatures\
**Created:** [January 6, 2025, 5:47pm UTC](https://community.emergingthreats.net/t/et-malware-gamaredon-apt-trycloudflare-activity/2327 "2025-01-06T17:47:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [January 6, 2025, 5:47pm UTC](https://community.emergingthreats.net/t/et-malware-gamaredon-apt-trycloudflare-activity/2327/1 "2025-01-06T17:47:57Z")

</div>

This signature is mostly looking for a delimiter that appears in recent Gamareddon activity to trycloudflare domains (they used similar characters in http URIs in previous campaigns and I don’t think any legitimate user agent has ::/. in it and the trycloudflare should limit it further).

This would require TLS decryption to see the traffic.

alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET MALWARE Gamaredon.APT TryCloudFlare Activity With User Agent Delimiter”; flow:established,to\_server; http.host; content:“.trycloudflare.com”; http.user\_agent; content:“|3A 3A|/.”; reference:url,[go.recordedfuture.com/hubfs/reports/cta-ru-2024-1205.pdf](http://go.recordedfuture.com/hubfs/reports/cta-ru-2024-1205.pdf); classtype:trojan-activity; sid:152131; rev:1;)

Kind Regards,  
Kevin Ross

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [January 7, 2025, 8:19pm UTC](https://community.emergingthreats.net/t/et-malware-gamaredon-apt-trycloudflare-activity/2327/2 "2025-01-07T20:19:55Z")

</div>

Happy New Year @kevross33 !

Thanks for the tip! This rule went out in yesterday’s release as `2058994 - ET MALWARE GammaLoad CnC Activity (GET)`

Cheers,  
Isaac

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [January 7, 2025, 9:07pm UTC](https://community.emergingthreats.net/t/et-malware-gamaredon-apt-trycloudflare-activity/2327/3 "2025-01-07T21:07:19Z")

</div>

Thanks @kevross33 @ishaughnessy !