A lot of malware campaigns use CloudFlare to mask their C2 infrastructure. They do this for a few reasons, but the primary reason is that it delays the inevitable of their C2 being taken down. The malware developers using CloudFlare isn't necessarily bad, and it isn't necessarily good, it's just a known thing that people abuse. Yes, CloudFlare did their job. CloudFlare takes down malware infrastructure a lot, despite people saying CloudFlare doesn't take any action, because CloudFlare is inundated with both legitimate and illegitimate takedown requests and reports daily. The daily reports they receive are (probably) in the millions daily. If they didn't want to hide behind CloudFlare, the malware developers could also have used a compromised website (very common), or Discord, or Google docs, or Spotify, or ... basically pick a website and service and it can be abused with enough elbow grease. The easiest, fastest, and easily configurable method is generic host with CloudFlare. When the domain is taken down, or CloudFlare takes it down, they simple spin up new infrastructure with a new CloudFlare account and operations resume as normal.