Known malicious kitcriticalother

BlueMoon / ShadowPad - Cloudflare Workers C2 tenants

family: bluemoon-shadowpad-2026-09

The actor's Cloudflare Workers C2 endpoints, by TENANT. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09).

Anchors

SMQL queryrun

domain:*daoahueb.workers.dev OR domain:*v93xdd5g.workers.dev OR domain:*mailtbox.workers.dev OR domain:*yhv41nji.workers.dev OR domain:*eduac.workers.dev OR domain:*centerfjdr658.workers.dev OR domain:*kmjukilo-lkjh.workers.dev

Provenance

Added: 2026-09-12 10:36

Never widen this to *.workers.dev: that is shared hosting and would match every Workers tenant on the internet. Named tenants only.

References:

https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

Sightings (1)

Host	Scan	Script	Match	When
app.eduac.workers.dev	b592f2e0…	—	query	2026-09-12 15:36