---
id: 6248
title: "Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign"
source_domain: hunt.io
source_url: "https://hunt.io/blog/russian-actor-cloudflare-phishing-telegram-c2"
published_at: "2025-04-01T00:00:00Z"
tags: ["phishing", "cloudflare", "lnk", "telegram", "pyramid-c2", "russian-actor"]
phying_url: "https://phying.com/item/6248"
lang: en
---

# Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign

## Summary

The Russian-speaking actor behind earlier EFF impersonation now runs Cloudflare-branded DMCA phishing with LNK files, Telegram-bot victim filtering, and Pyramid C2; an open directory exposed it.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-04-01T00:00:00Z
- **Original:** https://hunt.io/blog/russian-actor-cloudflare-phishing-telegram-c2
- **Phying News:** https://phying.com/item/6248