Loading story…
Breakglass Intelligence linked several live and historical campaigns to a persistent financially motivated actor abusing Cloudflare Quick Tunnels and misconfigured WsgiDAV WebDAV servers to stage invoice-themed malware against German-speaking organizations and later UK targets. Across operations tracked as Nutten Tunnel, WsgiDev Tunnel, Crest Snake, and Charger Van, victims were lured with PDF-like .LNK files that launched multi-stage chains through WSH, JScript, batch scripts, and embedded Python runtimes. Researchers tied the activity together through shared infrastructure, recurring script chains, identical LNK construction, reused metadata including the hostname vps-756346 and a Windows SID, and common tooling such as KISS Loader, XOR or AES-encrypted payloads, and anonymously writable WebDAV staging servers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Breakglass documented a persistent actor using Cloudflare Quick Tunnels and WsgiDAV infrastructure to deliver invoice-themed malware to German and UK businesses, including a newly analyzed charger-van-feb-circuit tunnel exposing a full chain ending in a Python-based KISS Loader and Donut shellcode injection into explorer.exe. The report also identified the older highland-trend-src-distinct staging tunnel and confirmed seven live tunnels linked by shared tooling as of 2026-04-05.
Researchers linked a new multi-tunnel Cloudflare Quick Tunnel campaign, dubbed Crest Snake, to the same operator behind Operation Nutten Tunnel through shared infrastructure, LNK construction patterns, WsgiDAV setup, and a reused Windows SID. The campaign expanded targeting from German-speaking users to UK victims and delivered five Python-based RATs plus a custom DLL using Early Bird APC injection.
Breakglass reported a live malware staging campaign on a trycloudflare.com tunnel using WsgiDAV 4.3.3 and anonymous read-write WebDAV access. The analysis added details on Startup-folder persistence via CryptoLoader.lnk and exposed OPSEC failures including VPS hostname vps-756346 and use of the Administrator account.
Researchers uncovered a previously unreported six-stage malware delivery chain hosted on a Cloudflare Quick Tunnel with an anonymously writable WsgiDAV server, targeting German-speaking users with a fake financial PDF shortcut lure. The chain progressed through WSH, JScript, batch, Python loader, and shellcode stages, ending with injection into explorer.exe.
A later reconstruction tied the actor's operations to activity running from 2026-01-14 through 2026-04-02, showing daily payload changes, tunnel rotation every 3 to 7 days, and experimentation with delivery methods.
Breakglass later identified payload archives in the previously unreported highland-trend-src-distinct tunnel dating back to 2025-11-28, making them the oldest known artifacts associated with this operator.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported an active cybercrime campaign abusing **Cloudflare Quick Tunnels** and **WsgiDAV** open directories to deliver multi-stage malware to victims in the UK and German-speaking regions. Lure files masquerading as invoices and scanned PDFs launched infection chains through **WSH/WSF**, **BAT**, **ZIP**, and Python stages, ultimately deploying multiple obfuscated Python RAT and stealer payloads and, in some cases, a native x64 DLL. Researchers tied the activity to the same operator behind **Operation Nutten Tunnel**, citing shared tunnel infrastructure, overlapping hosts, identical build artifacts, the same embedded Administrator SID, and consistent targeting patterns.
Jun 29, 2026
Breakglass Intelligence reported multiple active malware operations abusing **Cloudflare infrastructure**, WebDAV shares, and legitimate **Python** runtimes to deliver remote-access trojans and stealers through multi-stage infection chains. In the **SERPENTINE#CLOUD** activity, attackers used invoice-themed lures aimed primarily at German-speaking businesses, including spoofed DATEV documents delivered via `trycloudflare.com` tunnels exposing WsgiDAV servers. Victims were led through LNK, WSH, WSF, BAT, and URL shortcut stages before portable Python environments, shellcode loaders, and process injection into `explorer.exe` launched malware including **AsyncRAT, XWorm, DcRat, VenomRAT, Violet v5, PureHVNC, PureCrypter**, and the custom **PhilliVio** RAT. Researchers tied the campaign to at least 27 Cloudflare tunnel domains, persistent C2 infrastructure across multiple countries, and repeated operator OPSEC failures such as leaked builder hostnames and reusable metadata.
Jun 29, 2026
Researchers reported renewed **SERPENTINE#CLOUD** activity using Cloudflare Tunnel-hosted **WebDAV** delivery chains, with campaigns targeting both a previously compromised organization and German-speaking small businesses. In one intrusion attempt, Huntress said the actor returned just weeks after remediation of a six-month breach and used a **ClickFix** lure to trigger `rundll32.exe` loading `davclnt.dll` and fetching content from an ephemeral Cloudflare tunnel; defenders stopped the attack before payloads reached disk. Breakglass separately observed German-language lures disguised as legal documents, where a malicious `.lnk` file opened a legitimate invoice PDF as a decoy while staging scripts and downloading a clean Python runtime from `python.org`. Across both investigations, the operator reused a stable toolchain built around Python loaders and **Donut** shellcode while varying payloads and delivery details to evade detection. Huntress linked the latest attempt to prior activity through reused GUIDs, encryption material, loader templates, staging paths, DuckDNS infrastructure, and command-and-control consolidation to two AT&T residential IPs in Chicago; the payload set included **VenomRAT**, **AsyncRAT**, **XWorm/Violet**, **PureHVNC**, and a **Brute Ratel C4** wrapper. Breakglass found a custom Donut variant using a non-standard big-endian **Chaskey-CTR** counter and dual deployment of **dcRAT** and **XenoRAT v1.8.7** into separate `explorer.exe` processes via Early Bird APC injection, with a live XenoRAT server at `176.96.136[.]182`; researchers said the actor continues to rotate infrastructure quickly while preserving recognizable patterns such as WsgiDAV behind Cloudflare Quick Tunnels and a WebDAV share named **Music**.
Jun 29, 2026