PupyRAT

PupyRAT is an open-source, cross-platform remote access trojan and post-exploitation framework primarily written in Python. It is designed to provide remote control of compromised systems and has been observed operating on Windows, Linux, and Android. Its role in intrusion operations is typically as a flexible operator tool used after initial compromise, rather than as a self-propagating payload.

The malware has been used by multiple threat actors, including Iranian state-linked groups and other intrusion operators, in espionage-oriented campaigns. Reporting has associated its use with OilRig/APT34 and COBALT ILLUSION/APT35-related activity, including campaigns targeting government, private-sector, and energy-sector organizations. It has also been observed in exploitation chains following perimeter-device compromise, where attackers deployed remote access toolkits including PupyRAT to maintain access and conduct follow-on operations.

Observed delivery methods include malicious email attachments in phishing and job-themed lure campaigns, as well as deployment through fake or compromised websites in news media- and recruitment-themed operations. Once deployed, PupyRAT functions as a full-featured remote administration capability for adversaries, supporting interactive control and broader post-compromise activity. It is also notable in network detection research for distinctive TLS client behavior in some implementations, which has made it useful as an example of malware identifiable through JA3-style fingerprinting.

PupyRAT is widely recognized as a dual-use offensive security tool: legitimate for red-team or research contexts, but repeatedly repurposed in real-world malicious operations for covert access and post-exploitation.