Procedure examples

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

Remexi uses AutoIt and VBS scripts throughout its execution process.

Astaroth has used malicious VBS e-mail attachments for execution.

QakBot can use VBS to download and execute malicious files.

jRAT has been distributed as HTA files with VBScript.

One version of Helminth consists of VBScript scripts.

Comnie executes VBS scripts.

JSS Loader can download and execute VBScript files.

Remcos can execute VBS remotely.

Donut can generate shellcode outputs that execute via VBScript.

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .

During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.

During ShadowRay, threat actors used the Python `pty` module to open reverse shells.

During Salesforce Data Exfiltration, threat actors used custom applications developed in python.

During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.

Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.

MuddyWater has developed tools in Python including Out1.

Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.

ZIRCONIUM has used Python-based implants to interact with compromised hosts.

Rocke has used Python-based malware to install and spread their coinminer.

APT39 has used a command line utility and a network scanner written in python.

UNC3886 has used Python scripts to enumerate ESXi hosts and guest VMs.

Contagious Interview has used the Python-based malware such as InvisibleFerret to install and execute Python Packages and Python modules.

APT37 has used Python scripts to execute payloads.

Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.

RedCurl has used a Python script to establish outbound communication and to execute commands using SMB port 445.

APT29 has developed malware variants written in Python.

Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.

BRONZE BUTLER has made use of Python-based remote access tools.

Tonto Team has used Python-based tools for execution.

Earth Lusca used Python scripts for port scanning or building reverse shells.

VOID MANTICORE has utilized Python scripts to execute its malicious payloads.

reGeorg is a Python-based web shell.

InvisibleFerret is written in Python and has used Python scripts for execution.

UPSTYLE is a Python-based application.

PyDCrypt, along with its functions, is written in Python.

Turian has the ability to use Python to spawn a Unix shell.

THINCRUST can use Python scripts for command execution.

Machete is written in Python and is used in conjunction with additional Python scripts.

DropBook is a Python-based backdoor compiled with PyInstaller.

Keydnap uses Python for scripting to execute additional commands.

PUNCHBUGGY has used python scripts.

KeyBoy uses Python scripts for installing files and performing execution.

Lumma Stealer has used malicious Python scripts to execute payloads.

Chaes has used Python scripts for execution and the installation of additional files.

Bundlore has used Python scripts to execute payloads.

VIRTUALPIE is a Python-based backdoor malware.

Bandook can support commands to execute Python-based payloads.

Pysa has used Python scripts to deploy ransomware.