Cloudflare doesn't necessarily "support" hacker groups- although their CEO did a great talk at Defcon last year about keeping Lulsec up (which I consider more of an activist group than a hacker group, personally). However, they do very little to keep their network safe- they have no dedicated abuse team (or, if they do, they're impossible to contact directly), are slow to response to abuse requests (if they respond at all), and even when they do respond take only the most basic steps to filter the issues (which takes literally minutes for their account holders to work around, and they don't actually disable the accounts).

Dozens, if not hundreds, of hacker and malware related sites use Cloudflare to mask their origin and essentially use the other shared sites as hostages. If you block one of the malicious sites then you also end up blocking legitimate sites, and since Cloudflare goes out of their way to not take down sites (even those hosting malicious programs- including the drive by exploits that install them) it makes it very difficult to trace the malware back to it's source or actually take it down and stop people from getting infected.

Lulzsec was the most prominent, they used Cloudflare to keep their sites online, Cloudflare used it as a marketing tool, here's a blog post about it: http://blog.cloudflare.com/58611873

lulzsec