Loading story…
Researchers reported a targeted malware campaign against French government, construction, and real-estate organizations that used GDPR-themed phishing emails with macro-enabled Microsoft Word documents to deploy a backdoor dubbed Serpent. The infection chain relied on steganography, with the initial document fetching an image from fhccu.com that concealed a Base64-encoded PowerShell script; that script installed Chocolatey, then Python and related packages including pip and PySocks, before retrieving a second image containing the Python-based backdoor payload.
Once installed, Serpent contacted command-and-control infrastructure through Tor proxy domains such as onion.pet, polled for host-specific commands, executed them on compromised systems, and exfiltrated results by uploading output to termbin.com and returning the generated URL to a second C2 endpoint. Researchers also highlighted an unusual defense-evasion method in which schtasks.exe created a temporary scheduled task linked to Event ID 777, causing the payload to run as a child of taskhostsw.exe; despite the sophistication of the operation, the activity was not attributed to a known threat actor and the attackers’ ultimate objectives remained unclear.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
VMware published a technical analysis of the Serpent malware campaign targeting French government agencies and construction firms. The report detailed the phishing-based infection chain, steganographic payload delivery from fhccu.com, onion.pet command-and-control infrastructure, Termbin exfiltration, and provided YARA rules and indicators of compromise.
Proofpoint reported a targeted phishing campaign against French organizations in the construction, real estate, and government sectors that used macro-enabled Word documents and GDPR-themed lures to deploy a backdoor it named Serpent. The report described the attack chain using steganographic image payloads, Chocolatey, Python, Tor-accessible onion.pet C2 servers, and Termbin-based exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 35 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
pypi.org
Open sourceblogs.vmware.com
Open sourcebleepingcomputer.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A long-running espionage campaign targeted government and diplomatic entities in Southeast Asia using **GoSerpent**, a Go-based backdoor that researchers say has been active since late 2025, with earlier variants seen against regional victims as far back as 2021. The malware established persistence as a Windows service and used stealth features including encrypted arguments, obfuscated strings, and payload execution inside `svchost`, while command-and-control infrastructure was hosted through legitimate providers to blend in with normal traffic. The operators used GoSerpent to deploy follow-on tooling for file collection, credential dumping, proxying, and data theft, and later returned with an expanded toolkit that included **Stowaway** and the **TmcLoader/TmcPayload** exfiltration chain. Researchers said the activity showed deliberate coordination across intrusion stages, from initial backdoor access through credential theft and staged exfiltration, and noted a possible but unconfirmed connection to the **TetrisPhantom** threat actor.
Jul 24, 2026
Multiple phishing campaigns delivered **SnakeKeylogger**, **VIPKeylogger**, and **Agent Tesla** through layered infection chains that used obfuscated VBScript or PowerShell droppers, steganographic payload staging on Cloudinary, Internet Archive abuse, reflective in-memory .NET loading, and process hollowing into legitimate Windows binaries such as `Caspol.exe`, `Aspnet_compiler.exe`, and `RegAsm.exe`. One DHL-themed operation used a VIPKeylogger variant identified as a SnakeKeylogger rebrand, while a separate GuLoader campaign targeted Italian businesses with NSIS-wrapped stealers and business email compromise-style lures. Across the campaigns, the malware stole browser passwords, email and FTP credentials, Outlook and WinSCP secrets, Discord tokens, Wi-Fi passwords, screenshots, clipboard data, and keystrokes, then exfiltrated data over **SMTP**, **Telegram**, and **FTP**. Investigators found repeated operator OPSEC failures that exposed active criminal infrastructure and victim data. A VIPKeylogger/SnakeKeylogger operator left a stock **XAMPP** dashboard and internet-accessible **WinRM** open on `144.172.105.88`, while sandboxing captured plaintext SMTP credentials tied to `result@miniorangeman.com` on `185.196.9.150`; although that C2 was taken offline shortly after detection, the Cloudinary-hosted payload and SMTP infrastructure reportedly remained live. In a separate GuLoader operation, an open FTP directory on `holzbrenzii[.]com` exposed **52 credential dumps from 27 victim machines** in real time. Another SnakeKeylogger v4.4 campaign linked distinct droppers to the same backend through shared C2 strings, DDNS infrastructure, and staging artifacts, showing that technically capable malware operators repeatedly undermined their own campaigns by exposing panels, credentials, and stolen data.
Jun 29, 2026
The **Lazarus Group** ran a spearphishing campaign that delivered malicious Microsoft Word documents to targets in aerospace, defense, research, and financial sectors, including organizations linked to Boeing, BAE Systems, Lockheed Martin, and the Republic of Korea Army. The infection chain used remote template injection to fetch an external `DOTM` file, whose macro dropped a lure document and a malicious DLL such as `onenote.db` into the victim’s `AppData` path, then executed the implant while showing a decoy file to reduce suspicion. Related reporting describes similar Lazarus lures sent in spoofed emails, with separate payloads for 32-bit and 64-bit systems and reconnaissance-focused first-stage malware. The implant executed through **`rundll32.exe`** and established persistence via the Windows **Startup folder**, techniques widely tracked in MITRE ATT&CK as `T1218.011` and `T1547.001`. Once active, it collected host, process, and disk information, compressed or encrypted the data, and exfiltrated it over HTTP POST using compromised or attacker-controlled infrastructure, including IIS/Plesk-hosted domains such as `elite4print.com` and `astedams.it`. Analysts linked the activity to Lazarus based on recurring tradecraft, lure themes, victim profiling, and overlap with operations such as **Operation Dream Job**, where the group similarly abused `rundll32.exe` and autostart mechanisms for stealthy execution and persistence.
Aug 15, 2026