Known malicious kitcriticalother

BlueMoon / ShadowPad - Cloudflare Workers C2 tenants

family: bluemoon-shadowpad-2026-09

The actor's Cloudflare Workers C2 endpoints, by TENANT. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09) and MISP event 22904. SMQL hunts are DETECTORS, not verdict rules: match_tier 'smql' is excluded from both engines' verdict paths by design, so this collects sightings and shows a banner. Flooring for these indicators comes from the MISP feed via ioc-matcher.

Anchors

SMQL queryrun

domain:*daoahueb.workers.dev OR domain:*v93xdd5g.workers.dev OR domain:*mailtbox.workers.dev OR domain:*yhv41nji.workers.dev OR domain:*eduac.workers.dev OR domain:*centerfjdr658.workers.dev OR domain:*kmjukilo-lkjh.workers.dev

Provenance

Added: 2026-09-12 10:36

NEVER widen this to *.workers.dev - that is shared hosting and would match every Workers tenant on the internet. Named tenants only. 7 nodes. 0 matches at creation.

References:

https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

Sightings (1)

Host	Scan	Script	Match	When
app.eduac.workers.dev	b592f2e0…	—	query	2026-09-12 15:36