Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The SERPENTINE#CLOUD campaign leverages Cloudflare Tunnels and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts. The attack begins with malicious .lnk files disguised as documents, fetching remote code from Cloudflare subdomains. The infection chain involves batch, VBScript, and Python stages, ultimately deploying shellcode that loads a Donut-packed PE payload. The campaign focuses on Western targets, using Cloudflare for payload hosting and anonymity. It demonstrates evolving tactics, shifting from simple .url files to sophisticated .lnk payloads. The final stage involves a RAT payload, giving attackers full control over infected hosts.

The SERPENTINE#CLOUD campaign is a sophisticated malware operation that abuses Cloudflare Tunnels to deliver stealthy, Python-based malware payloads to targeted systems. The attack initiates through malicious Windows shortcut (.lnk) files that are disguised as legitimate documents to entice victims into execution. These shortcuts fetch remote code hosted on Cloudflare subdomains, leveraging Cloudflare's infrastructure to provide anonymity and evade traditional detection mechanisms. The infection chain is multi-staged and complex, involving batch scripts, VBScript, and Python loaders that work together to execute memory injection techniques. The final payload is a shellcode loader that uses the Donut packer to embed a Portable Executable (PE) payload directly into memory, avoiding disk writes and reducing forensic footprints. This PE payload is a Remote Access Trojan (RAT), specifically linked to variants such as AsyncRAT and RevengeRAT, granting attackers full control over compromised hosts. The campaign has evolved from using simpler .url files to more complex .lnk files, indicating an adaptive threat actor improving stealth and delivery mechanisms. The use of obfuscation and memory injection techniques further complicates detection and analysis. The campaign primarily targets Western organizations, exploiting the trust and ubiquity of Cloudflare services to host malicious payloads and maintain operational security. No known exploits in the wild have been reported yet, but the campaign's medium severity rating reflects its potential impact and stealth capabilities.

Detailed information about Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware. Get real-tim

Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware

Banana Squad, a threat actor first identified in 2023, has launched a new campaign targeting GitHub repositories. The group has created over 60 trojanized repositories masquerading as hacking tools written in Python. These malicious repositories contain hundreds of trojanized Python files that utilize encoding and encryption techniques to hide backdoor code. The campaign primarily uses the domain dieserbenni[.]ru, with a new domain 1312services[.]ru detected recently. The trojanized repositories exploit GitHub's UI feature where long lines of code don't wrap, allowing attackers to hide malicious code off-screen. This sophisticated technique makes visual detection challenging, highlighting the increasing stealth of supply chain attacks on open-source platforms.

The threat actor known as Banana Squad, first identified in 2023, has initiated a new campaign targeting GitHub repositories by creating over 60 trojanized repositories disguised as hacking tools written in Python. These repositories contain hundreds of malicious Python files that employ encoding and encryption techniques to conceal backdoor code. The campaign leverages GitHub's user interface behavior where long lines of code do not wrap, allowing attackers to hide malicious payloads off-screen and evade visual detection by reviewers. The malicious repositories primarily communicate with command and control (C2) infrastructure hosted on domains such as dieserbenni[.]ru and the recently observed 1312services[.]ru. This approach exemplifies a sophisticated supply chain attack on open-source platforms, exploiting trust in publicly available code and the collaborative nature of GitHub. The use of encoding and encryption complicates static analysis and detection by automated tools. The campaign's tactics align with multiple MITRE ATT&CK techniques including T1132.001 (Data Encoding), T1204.002 (User Execution: Malicious File), T1553.002 (Subvert Trust Controls), T1140 (Deobfuscate/Decode Files or Information), T1608.001 (Stage Capabilities), T1027 variants (Obfuscated Files or Information), T1588.001 (Obtain Capabilities), T1078 (Valid Accounts), T1102.002 (Web Service), and T1059.006 (Command and Scripting Interpreter: Python). Although no known exploits in the wild have been reported yet, the campaign's stealth and supply chain nature pose significant risks to organizations relying on open-source Python tools from GitHub.

Detailed information about Threat actor Banana Squad exploits GitHub repos in new campaign. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'stealth techniques'

Filter Threats

Threats Tagged 'stealth techniques'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility