Target Industry

Indiscriminate, opportunistic targeting.

Overview

A new malware campaign called SERPENTINE#CLOUD has been discovered by Securonix. The campaign uses Cloudflare Tunnel subdomains to host and deliver malicious payloads via phishing emails. 

Impact

The SERPENTINE#CLOUD malware campaign can have several significant impacts on organisations. The malware can steal sensitive data, including personal information, financial records, and intellectual property, leading to data breaches and potential regulatory fines. The infection process can disrupt normal business operations, causing downtime and affecting productivity. This can be particularly damaging for critical infrastructure and services. The malware utilises legitimate cloud services to evade detection and employs extensive code obfuscation.  

Exploitation

The malware uses Cloudflare Tunnel subdomains to host and deliver malicious payloads via phishing emails. The infection chain starts with phishing emails containing Windows shortcut (LNK) files disguised as documents. Payload execution involves multiple stages, including Python-based shellcode loaders and Donut-packed payloads (an open-source tool designed to generate shellcode payloads that can be executed entirely in memory). 

Indicators of Compromise

An extensive list of the indicators of compromise can be found in the analysis of the malware by Securonix.  

Containment, Mitigations & Remediations

It is highly recommended to educate employees on phishing awareness, to avoid downloading files or attachments from unsolicited emails, especially ZIP, RAR, ISO, and PDF files. Enable file extension visibility in Windows to identify suspicious file types. Monitor common malware staging directories and script-related activity in writable directories, such as the user’s home directory.  

Deploy robust endpoint logging capabilities, including Sysmon and PowerShell logging, to detect suspicious activities. Monitor traffic to Cloudflare Tunnel subdomains and other suspicious domains listed in the report. There are also threat hunting rules to aid detection on the Securonix webpage. 

Threat Landscape

Cloudflare Tunnels are used globally by a broad range of organisations, from small businesses to large enterprises, to securely connect their infrastructure to the internet. The campaign has been noted to target the United States, United Kingdom, Germany, and other regions in Europe and Asia.  

Threat Group

The identity of the threat actors is unknown, but they are noted for their English fluency. The campaign may be a continuation of previous attacks or involve different actors using similar tactics. 

TTPs

Further Information

Dark Reading article