# SIG: ET MALWARE Gamaredon TryCloudFlare Activity - Known Delimiter in User-Agent

**URL:** <https://community.emergingthreats.net/t/sig-et-malware-gamaredon-trycloudflare-activity-known-delimiter-in-user-agent/2758>\
**Category:** Rule Signatures\
**Created:** [May 22, 2025, 5:55pm UTC](https://community.emergingthreats.net/t/sig-et-malware-gamaredon-trycloudflare-activity-known-delimiter-in-user-agent/2758 "2025-05-22T17:55:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [May 22, 2025, 5:55pm UTC](https://community.emergingthreats.net/t/sig-et-malware-gamaredon-trycloudflare-activity-known-delimiter-in-user-agent/2758/1 "2025-05-22T17:55:24Z")

</div>

alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET MALWARE Gamaredon APT TryCloudFlare Activity - Known Delimiter in User-Agent”; flow:established,to\_server; http.host; content:“.trycloudflare.com”; http.user\_agent; content:“|3B 3B|/.”; classtype:trojan-activity; reference:url,[Inside Gamaredon's PteroLNK: Dead Drop Resolvers and evasive Infrastructure - HarfangLab | Your endpoints, our protection](http://harfanglab.io/insidethelab/gamaredons-pterolnk-analysis/); sid:154001; rev:1;)

Kind Regards,  
Kevin Ross

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [May 22, 2025, 10:40pm UTC](https://community.emergingthreats.net/t/sig-et-malware-gamaredon-trycloudflare-activity-known-delimiter-in-user-agent/2758/2 "2025-05-22T22:40:32Z")

</div>

hey @kevross33 - thanks for sending our way! Here are the sid details:

```auto
  2062541 - Gamaredon APT TryCloudFlare CnC Activity - Known Delimiter in User-Agent

```