Loading malware…
VIPERTUNNEL is a Python-based Windows backdoor that establishes persistent access through a scheduled task and abuse of Python's automatically loaded sitecustomize hook. It uses an obfuscated Python payload masquerading as a DLL, decrypts and executes staged code in memory, and creates an outbound SOCKS5 tunnel over port 443. Its proxy components relay command-and-control-directed traffic into the victim environment, enabling concealed remote access and network pivoting. VIPERTUNNEL has been observed in UK and US business environments, including as a follow-on payload after SocGholish/FAKEUPDATES infections, and has been used to maintain access preceding ransomware activity. The malware employs layered encoding, compression, encryption, and control-flow obfuscation to hinder analysis.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The report details the analysis of VIPERTUNNEL, a Python based backdoor that achieves persistence via a scheduled task and leverages a malicious sitecustomize.py to load an obfuscated DLL.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
ViperTunnel ... is often deployed following FAKEUPDATES (SocGholish) infections, aiming to establish long-term access before being sold to ransomware groups.
Technique - T1053.005 Scheduled Task : Persistence Description : Creates or modifies a scheduled task to execute malicious code at system boot or on a schedule.
The file b5yogiiy3c.dll is an python script... The payload is processed with compile() , using a synthetic filename... and exec mode, then executed immediately... Pyramid ... evades EDR detection by using the LOLBin python.exe to run Python code in memory.
They found that the attackers were using a clever trick involving a file named sitecustomize.py located in C:\ProgramData\cp49s\Lib\ . This is a standard Python module, but because it loads automatically when the interpreter starts, it allows hackers to run their code without any manual input.
Technique - T1053.005 Scheduled Task : Persistence Description : Creates or modifies a scheduled task to execute malicious code at system boot or on a schedule.
Python's site module loads these hooks from directories on sys.path before Python is executed. If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
Technique - T1053.005 Scheduled Task : Persistence Description : Creates or modifies a scheduled task to execute malicious code at system boot or on a schedule.
Python's site module loads these hooks from directories on sys.path before Python is executed. If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
Technique - T1027 Obfuscated Files or Information Description : Uses encoding, compression and cryptographic primitives to hide malicious code.
Technique - T1027.004 Compile After Delivery Description : Compiles recovered code in memory using compile() and exec().
Disguised as a DLL file, the malware's code is heavily obfuscated using multiple encryption layers...
Technique - T1140 Deobfuscate/Decode Files or Information Description : Decodes Base85 and other transformations to recover next-stage code.
They found that the attackers were using a clever trick involving a file named sitecustomize.py located in C:\ProgramData\cp49s\Lib\ . This is a standard Python module, but because it loads automatically when the interpreter starts, it allows hackers to run their code without any manual input.
Technique - T1620 Reflective Code Loading Description : Loads and runs code directly from memory without writing to disk.
The most concerning find was a new check for TracerPid in Linux system files.
The most concerning find was a new check for TracerPid in Linux system files.
The proxy uses port 443 for outbound connections, blending with typical HTTPS traffic to evade detection.
It establishes a SOCKS5 proxy on port 443, mimicking legitimate web traffic to conceal data exfiltration.
Technique - T1090.001 Proxy Internal Proxy Description : Uses internal proxy components to relay traffic.
Technique - T1090.002 Proxy External Proxy Description : Establishes an external SOCKS5 proxy to forward traffic.
Technique - T1102 Web Service Description : Communicates with C2 over HTTPS using custom Pyramid service.
it is currently being used to maintain long-term access to systems before selling that entry to major ransomware groups like RansomHub.
Technique - T1571 Non-Standard Port Description : Uses port 443 to blend with legitimate HTTPS traffic.
Technique - T1572 Protocol Tunneling Description : Encapsulates victim traffic inside SOCKS5 tunnel.
Technique - T1573 Encrypted Channel Description : Encrypts C2 communication with ChaCha20/XOR.
It establishes a SOCKS5 proxy on port 443, mimicking legitimate web traffic to conceal data exfiltration.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.