Procedure examples

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.

Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.

MuddyWater has developed tools in Python including Out1.

Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.

ZIRCONIUM has used Python-based implants to interact with compromised hosts.

Rocke has used Python-based malware to install and spread their coinminer.

APT39 has used a command line utility and a network scanner written in python.

UNC3886 has used Python scripts to enumerate ESXi hosts and guest VMs.

Contagious Interview has used the Python-based malware such as InvisibleFerret to install and execute Python Packages and Python modules.

APT37 has used Python scripts to execute payloads.

Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.

RedCurl has used a Python script to establish outbound communication and to execute commands using SMB port 445.

APT29 has developed malware variants written in Python.

Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.

BRONZE BUTLER has made use of Python-based remote access tools.

Tonto Team has used Python-based tools for execution.

Earth Lusca used Python scripts for port scanning or building reverse shells.

VOID MANTICORE has utilized Python scripts to execute its malicious payloads.

TeamPCP has poisoned PyPi packages with malicious code and has used a 13 file modular Python framework for data collection.