SERPENTINE#CLOUD Suspicious Notepad.exe Network Connection

Mehulkumar Savajani@Msavajani

•updated Nov 27, 2025•5•0•126

Detects network connections originating from notepad.exe to suspicious domains or IP addresses. This is a high-fidelity indicator of compromise associated with the SERPENTINE#CLOUD campaign, where a malicious payload is injected into the notepad.exe process for C2 communications.