APT37 NarwhalRAT pCloud Dead-Drop C2 Resolution from Suspicious Process

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects suspected NarwhalRAT activity where a process (e.g., userscreen.exe or pythonw.exe in suspicious locations) communicates with the pCloud API to resolve a dead-drop location, followed within 60 seconds by a beacon connection to a different remote IP, characteristic of C2 communication.