Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The SERPENTINE#CLOUD campaign leverages Cloudflare Tunnels and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts. The attack begins with malicious .lnk files disguised as documents, fetching remote code from Cloudflare subdomains. The infection chain involves batch, VBScript, and Python stages, ultimately deploying shellcode that loads a Donut-packed PE payload. The campaign focuses on Western targets, using Cloudflare for payload hosting and anonymity. It demonstrates evolving tactics, shifting from simple .url files to sophisticated .lnk payloads. The final stage involves a RAT payload, giving attackers full control over infected hosts.

The SERPENTINE#CLOUD campaign is a sophisticated malware operation that abuses Cloudflare Tunnels to deliver stealthy, Python-based malware payloads to targeted systems. The attack initiates through malicious Windows shortcut (.lnk) files that are disguised as legitimate documents to entice victims into execution. These shortcuts fetch remote code hosted on Cloudflare subdomains, leveraging Cloudflare's infrastructure to provide anonymity and evade traditional detection mechanisms. The infection chain is multi-staged and complex, involving batch scripts, VBScript, and Python loaders that work together to execute memory injection techniques. The final payload is a shellcode loader that uses the Donut packer to embed a Portable Executable (PE) payload directly into memory, avoiding disk writes and reducing forensic footprints. This PE payload is a Remote Access Trojan (RAT), specifically linked to variants such as AsyncRAT and RevengeRAT, granting attackers full control over compromised hosts. The campaign has evolved from using simpler .url files to more complex .lnk files, indicating an adaptive threat actor improving stealth and delivery mechanisms. The use of obfuscation and memory injection techniques further complicates detection and analysis. The campaign primarily targets Western organizations, exploiting the trust and ubiquity of Cloudflare services to host malicious payloads and maintain operational security. No known exploits in the wild have been reported yet, but the campaign's medium severity rating reflects its potential impact and stealth capabilities.

Detailed information about Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware. Get real-tim

Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'donut packer'

Filter Threats

Threats Tagged 'donut packer'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility