Screening Serpens MiniUpdate RAT - Azure C2 Beacon from User-Writable Directories

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects outbound network connections to common Azure-related domains originating from suspicious file paths such as Temp, Downloads, or AppData subdirectories. This behavior is indicative of potential malware or unauthorized scripts executing from temporary user locations to reach out to cloud infrastructure.