Loading story…
Breakglass Intelligence reported multiple active malware operations abusing Cloudflare infrastructure, WebDAV shares, and legitimate Python runtimes to deliver remote-access trojans and stealers through multi-stage infection chains. In the SERPENTINE#CLOUD activity, attackers used invoice-themed lures aimed primarily at German-speaking businesses, including spoofed DATEV documents delivered via trycloudflare.com tunnels exposing WsgiDAV servers. Victims were led through LNK, WSH, WSF, BAT, and URL shortcut stages before portable Python environments, shellcode loaders, and process injection into explorer.exe launched malware including AsyncRAT, XWorm, DcRat, VenomRAT, Violet v5, PureHVNC, PureCrypter, and the custom PhilliVio RAT. Researchers tied the campaign to at least 27 Cloudflare tunnel domains, persistent C2 infrastructure across multiple countries, and repeated operator OPSEC failures such as leaked builder hostnames and reusable metadata.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On March 30, 2026, Breakglass observed a new SERPENTINE#CLOUD wave simultaneously deploying AsyncRAT, VenomRAT, and the newly identified custom RAT PhilliVio through four active trycloudflare.com tunnels. The campaign remained live that day, showing continued daily infrastructure rotation and persistent targeting activity.
On March 12, 2026, Breakglass published technical analysis of an active campaign in which ACRStealer delivered SectopRAT through layered Python obfuscation, a 21-second sandbox-evasion delay, a CLR-based AMSI bypass, and fiber-based shellcode execution. The malware chain targeted browser credentials, application secrets, and cryptocurrency wallets.
On March 10, 2026, Breakglass confirmed that the primary SectopRAT server at 94[.]26[.]106[.]216:9000 was live and answering unauthenticated requests on the /wbinjget and /wmglb endpoints. This validated that the ACRStealer-to-SectopRAT campaign infrastructure was actively operational.
In the March 2026 SERPENTINE#CLOUD investigation, Breakglass identified command-and-control servers at 178.16.55[.]160 and 43.157.1[.]71 and linked multiple RAT families to a single operator. The report also noted an OPSEC failure in LNK metadata exposing the builder hostname "vincent-pc" and a reusable SID fingerprint.
By early March 2026, researchers documented an active SERPENTINE#CLOUD wave using fake DATEV invoice lures delivered through dual trycloudflare.com tunnels exposing WsgiDAV shares. The infection chain deployed XWorm, DcRat, and PureCrypter, and established persistence through Startup, Registry Run, and scheduled task mechanisms.
Breakglass mapped seven ACRStealer C2 servers and four SectopRAT C2 servers that were active beginning on February 20, 2026. The infrastructure supported a multi-stage campaign delivering SectopRAT via ACRStealer using Cloudflare, MediaFire, and a renamed Python interpreter.
Breakglass reported that the financially motivated SERPENTINE#CLOUD phishing and RAT-delivery campaign had been operating continuously since at least November 2025, primarily targeting German-speaking businesses and also showing confirmed UK targeting. The cluster used Cloudflare Quick Tunnels, exposed WsgiDAV servers, and multiple RAT families across repeated waves.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported renewed **SERPENTINE#CLOUD** activity using Cloudflare Tunnel-hosted **WebDAV** delivery chains, with campaigns targeting both a previously compromised organization and German-speaking small businesses. In one intrusion attempt, Huntress said the actor returned just weeks after remediation of a six-month breach and used a **ClickFix** lure to trigger `rundll32.exe` loading `davclnt.dll` and fetching content from an ephemeral Cloudflare tunnel; defenders stopped the attack before payloads reached disk. Breakglass separately observed German-language lures disguised as legal documents, where a malicious `.lnk` file opened a legitimate invoice PDF as a decoy while staging scripts and downloading a clean Python runtime from `python.org`. Across both investigations, the operator reused a stable toolchain built around Python loaders and **Donut** shellcode while varying payloads and delivery details to evade detection. Huntress linked the latest attempt to prior activity through reused GUIDs, encryption material, loader templates, staging paths, DuckDNS infrastructure, and command-and-control consolidation to two AT&T residential IPs in Chicago; the payload set included **VenomRAT**, **AsyncRAT**, **XWorm/Violet**, **PureHVNC**, and a **Brute Ratel C4** wrapper. Breakglass found a custom Donut variant using a non-standard big-endian **Chaskey-CTR** counter and dual deployment of **dcRAT** and **XenoRAT v1.8.7** into separate `explorer.exe` processes via Early Bird APC injection, with a live XenoRAT server at `176.96.136[.]182`; researchers said the actor continues to rotate infrastructure quickly while preserving recognizable patterns such as WsgiDAV behind Cloudflare Quick Tunnels and a WebDAV share named **Music**.
Jun 29, 2026
Breakglass Intelligence reported an active cybercrime campaign abusing **Cloudflare Quick Tunnels** and **WsgiDAV** open directories to deliver multi-stage malware to victims in the UK and German-speaking regions. Lure files masquerading as invoices and scanned PDFs launched infection chains through **WSH/WSF**, **BAT**, **ZIP**, and Python stages, ultimately deploying multiple obfuscated Python RAT and stealer payloads and, in some cases, a native x64 DLL. Researchers tied the activity to the same operator behind **Operation Nutten Tunnel**, citing shared tunnel infrastructure, overlapping hosts, identical build artifacts, the same embedded Administrator SID, and consistent targeting patterns.
Jun 29, 2026
Breakglass Intelligence linked several live and historical campaigns to a persistent financially motivated actor abusing **Cloudflare Quick Tunnels** and misconfigured **WsgiDAV** WebDAV servers to stage invoice-themed malware against German-speaking organizations and later UK targets. Across operations tracked as **Nutten Tunnel**, **WsgiDev Tunnel**, **Crest Snake**, and **Charger Van**, victims were lured with PDF-like `.LNK` files that launched multi-stage chains through WSH, JScript, batch scripts, and embedded Python runtimes. Researchers tied the activity together through shared infrastructure, recurring script chains, identical LNK construction, reused metadata including the hostname `vps-756346` and a Windows SID, and common tooling such as KISS Loader, XOR or AES-encrypted payloads, and anonymously writable WebDAV staging servers.
Jun 29, 2026