Procedure examples

SpeakUp uses Python scripts.

Cobalt Strike can use Python to perform execution.

Neo-reGeorg is a Python-based web shell.

FRAMESTING is a Python web shell that can embed in the Ivanti Connect Secure CAV Python package.

LAMEHUG can use Python scripts for execution.

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.

CoinTicker executes a Python script to download its second stage.

SPAWNCHIMERA has searched the contents of two Python files scanner.py and scanner_legacy.py by searching for specific lines and replacing them with values that reduce their ability to track mismatches or new files.

Ebury has used Python to implement its DGA.

VIRTUALPITA can call a Python script to run commands on a targeted guest virtual machine.

MechaFlounder uses a python-based payload.

DRYHOOK is a Python-based script that executes within the victim environment.

CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.

Lizar has used Python scripts (ps2x.py script and ps2p.py) to execute files on remote hosts using the Impacket library.

Small Sieve can use Python scripts to execute commands.

SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.

Remcos uses Python scripts.

Donut can generate shellcode outputs that execute via Python.

IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.

TeamPCP Cloud Stealer has leveraged Python scripts to download additional payloads, engage in discovery, and to establish persistence.

Mini Shai-Hulud has utilized Python scripts to execute payloads.

CanisterWorm has used a Python script as a second-stage backdoor.

TeamPCP has poisoned PyPi packages with malicious code and has used a 13 file modular Python framework for data collection.

During Operation Dust Storm, the threat actors used JavaScript code.

Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.

During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.

Pikabot Distribution February 2024 utilized obfuscated JavaScript files for initial Pikabot payload download.

During C0017, APT41 deployed JScript web shells on compromised systems.

Indrik Spider has used malicious JavaScript files for several components of their attack.

Kimsuky has used JScript for logging and downloading additional tools. Kimsuky has used TRANSLATEXT, which contained four Javascript files for bypassing defenses, collecting sensitive information and screenshots, and exfiltrating data.

TA577 has used JavaScript to execute additional malicious payloads.

Evilnum has used malicious JavaScript files on the victim's machine.

APT32 has used JavaScript for drive-by downloads and C2 communications.

MuddyWater has used JavaScript files to execute its POWERSTATS payload.

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.

Leafminer infected victims using JavaScript code.

FIN7 used JavaScript scripts to help perform tasks on the victim's machine.

Sidewinder has used JavaScript to drop and execute malware loaders.

Mustang Panda has executed a JavaScript payload utilizing wscript.exe on the endpoint.

Contagious Interview has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js.

Higaisa used JavaScript to execute additional files.

Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.

MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.

Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.

Turla has used various JavaScript-based backdoors.

TA505 has used JavaScript for code execution.

Star Blizzard has used JavaScript to redirect victim traffic from an adversary controlled server to a server hosting the Evilginx phishing framework.

TA578 has used JavaScript files in malware execution chains.

LazyScripter has used JavaScript in its attacks.