9/3/25, 8:30 PM

Researchers from Cado Security (now part of Darktrace) report that Cloudflare’s WARP service, a free VPN, has been abused in opportunistic attacks to target vulnerable internet-facing services, with WARP traffic often bypassing firewalls due to its trusted status. These campaigns, including the SSWW mining operation, exploit the trust placed in Cloudflare’s IP ranges by administrators who may allow WARP traffic in security controls.

The SSWW campaign targets exposed Docker instances and uses Cloudflare WARP for initial access; the C2 server appeared to be created on 5 September 2023, while the first attack detected by Cado’s honeypot was on 21 February 2024.

The attacker’s chain involves a PowerShell-based dropper that fetches an XMRig miner, with the activity tied to Monero mining endpoints such as gulf.moneroocean[.]stream and monerooceans[.]stream, and the attackers’ C2 and mining infrastructure being hosted across multiple VPS providers in Europe. The report advises organisations not to permit Cloudflare 104.0.0[.]0/16 in firewalls and to pursue a defence-in-depth approach, noting that Autonomous Response can block suspicious outbound connections within seconds.