SERPENTINE#CLOUD Disguised Batch Execution

Tim Peck@timpeck

•updated Apr 6, 2026•9•0•247

Detects cmd.exe executing a batch script disguised with a .txt extension, a persistence technique used by SERPENTINE#CLOUD. The campaign delivers VenomRAT, AsyncRAT, XWorm/Violet, PureHVNC, and Brute Ratel C4 via ClickFix lures and Cloudflare tunnels.