Curious Serpens

Curious Serpens is Palo Alto Networks Unit 42's designation for a subset of OilRig activity documented in late 2023 and early 2024, focused on espionage operations against the defense industrial base and technology sectors. Unit 42 documented the group deploying a Python-based backdoor named FalseFont in campaigns targeting defense contractors, demonstrating continued OilRig capability development. The Curious Serpens designation reflects Unit 42's tracking of this specific campaign cluster within the broader OilRig/APT34 operational infrastructure linked to Iranian MOIS.