Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The SERPENTINE#CLOUD campaign leverages Cloudflare Tunnels and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts. The attack begins with malicious .lnk files disguised as documents, fetching remote code from Cloudflare subdomains. The infection chain involves batch, VBScript, and Python stages, ultimately deploying shellcode that loads a Donut-packed PE payload. The campaign focuses on Western targets, using Cloudflare for payload hosting and anonymity. It demonstrates evolving tactics, shifting from simple .url files to sophisticated .lnk payloads. The final stage involves a RAT payload, giving attackers full control over infected hosts.

The SERPENTINE#CLOUD campaign is a sophisticated malware operation that abuses Cloudflare Tunnels to deliver stealthy, Python-based malware payloads to targeted systems. The attack initiates through malicious Windows shortcut (.lnk) files that are disguised as legitimate documents to entice victims into execution. These shortcuts fetch remote code hosted on Cloudflare subdomains, leveraging Cloudflare's infrastructure to provide anonymity and evade traditional detection mechanisms. The infection chain is multi-staged and complex, involving batch scripts, VBScript, and Python loaders that work together to execute memory injection techniques. The final payload is a shellcode loader that uses the Donut packer to embed a Portable Executable (PE) payload directly into memory, avoiding disk writes and reducing forensic footprints. This PE payload is a Remote Access Trojan (RAT), specifically linked to variants such as AsyncRAT and RevengeRAT, granting attackers full control over compromised hosts. The campaign has evolved from using simpler .url files to more complex .lnk files, indicating an adaptive threat actor improving stealth and delivery mechanisms. The use of obfuscation and memory injection techniques further complicates detection and analysis. The campaign primarily targets Western organizations, exploiting the trust and ubiquity of Cloudflare services to host malicious payloads and maintain operational security. No known exploits in the wild have been reported yet, but the campaign's medium severity rating reflects its potential impact and stealth capabilities.

Detailed information about Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware. Get real-tim

Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware

A new PowerShell-based shellcode loader has been discovered, designed to execute a variant of Remcos RAT. The attack chain begins with malicious LNK files in ZIP archives, using mshta.exe for initial execution. The loader employs fileless techniques, executing code directly in memory to evade traditional defenses. It leverages Windows APIs to allocate memory and execute binary code. The Remcos RAT provides full system control, featuring keylogging, screen capture, and credential theft capabilities. It uses advanced evasion techniques like process hollowing and UAC bypass. The malware establishes persistence through registry modifications and connects to a command and control server over TLS. This sophisticated attack emphasizes the need for behavioral analytics and proactive security measures to detect and mitigate such stealthy threats.

This threat involves a sophisticated fileless malware attack leveraging PowerShell to load and execute shellcode directly in memory, thereby bypassing traditional file-based detection mechanisms. The attack initiates via malicious LNK shortcut files embedded within ZIP archives, which when opened, trigger mshta.exe to execute the initial payload. The PowerShell-based loader then uses Windows API calls to allocate memory and execute binary code without writing files to disk, significantly enhancing stealth. The payload is a variant of Remcos RAT, a remote access trojan that grants attackers full control over the compromised system. Remcos RAT capabilities include keylogging, screen capture, credential theft, and other espionage functions. It employs advanced evasion techniques such as process hollowing—injecting malicious code into legitimate processes—and User Account Control (UAC) bypass to escalate privileges without user consent. Persistence is achieved through registry modifications, ensuring the malware survives system reboots. Communication with the command and control (C2) server is conducted over encrypted TLS channels, complicating network detection. This attack chain exemplifies modern threat actor tactics that emphasize stealth, memory-resident execution, and multi-layered evasion, making detection and mitigation challenging without behavioral analytics and endpoint detection and response (EDR) solutions capable of monitoring in-memory activities and anomalous process behaviors.

Detailed information about Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT. Get real-time updates, technical details, and mitigation s

Title	Severity	Type	Source	Date

Threats Tagged 'shellcode loader'

Filter Threats

Threats Tagged 'shellcode loader'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility