Loading malware…
ViperTunnel is a Python-based backdoor used to maintain persistent access in compromised environments, with observed activity affecting businesses in the United Kingdom and United States. It has been associated in reporting with UNC2165, a cluster linked to EvilCorp, and has been described as an access-maintenance tool that can precede ransomware operations or the resale of network access to other criminal actors. ViperTunnel has also been observed in intrusion chains following FAKEUPDATES, also known as SocGholish.
On Windows, ViperTunnel achieves persistence through a scheduled task and abuses Python site hooks for execution. A malicious sitecustomize.py is used so that code runs automatically when the Python interpreter starts, and the payload may masquerade as a DLL while actually containing heavily obfuscated Python code. Analysis of recovered samples shows multiple layers of encoding, compression, and encryption, with staged decryption and in-memory execution designed to hinder static analysis and reverse engineering.
Its core functionality is to establish an outbound SOCKS5 tunnel to command-and-control infrastructure, effectively turning the infected host into a relay or proxy for operator traffic. Recovered payloads implement this behavior through modular components responsible for socket handling, relay operations, and command management. Communications have been linked to Pyramid C2 infrastructure and are designed to blend with normal network activity by using common web ports and encrypted traffic. This tunneling capability supports covert operator access and follow-on intrusion activity inside victim networks.
ViperTunnel is notable for its evolution from early, less polished builds into a more modular and stealth-focused framework. Reporting also notes overlap in tradecraft with ShadowCoil and the presence of Linux-related anti-debugging artifacts, although currently observed attacks are focused on Windows systems. The malware is therefore best characterized as a persistent Python backdoor and proxying framework used for long-term footholds and post-compromise access operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The report details the analysis of VIPERTUNNEL, a Python based backdoor that achieves persistence via a scheduled task and leverages a malicious sitecustomize.py to load an obfuscated DLL.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Technique - T1053.005 Scheduled Task : Persistence Description : Creates or modifies a scheduled task to execute malicious code at system boot or on a schedule.
The file b5yogiiy3c.dll is an python script... The payload is processed with compile() , using a synthetic filename... and exec mode, then executed immediately... Pyramid ... evades EDR detection by using the LOLBin python.exe to run Python code in memory.
They found that the attackers were using a clever trick involving a file named sitecustomize.py located in C:\ProgramData\cp49s\Lib\ . This is a standard Python module, but because it loads automatically when the interpreter starts, it allows hackers to run their code without any manual input.
Technique - T1027 Obfuscated Files or Information Description : Uses encoding, compression and cryptographic primitives to hide malicious code.
Technique - T1027.004 Compile After Delivery Description : Compiles recovered code in memory using compile() and exec().
Disguised as a DLL file, the malware's code is heavily obfuscated using multiple encryption layers...
Technique - T1140 Deobfuscate/Decode Files or Information Description : Decodes Base85 and other transformations to recover next-stage code.
They found that the attackers were using a clever trick involving a file named sitecustomize.py located in C:\ProgramData\cp49s\Lib\ . This is a standard Python module, but because it loads automatically when the interpreter starts, it allows hackers to run their code without any manual input.
The proxy uses port 443 for outbound connections, blending with typical HTTPS traffic to evade detection.
It establishes a SOCKS5 proxy on port 443, mimicking legitimate web traffic to conceal data exfiltration.
Technique - T1090.001 Proxy Internal Proxy Description : Uses internal proxy components to relay traffic.
Technique - T1090.002 Proxy External Proxy Description : Establishes an external SOCKS5 proxy to forward traffic.
Technique - T1102 Web Service Description : Communicates with C2 over HTTPS using custom Pyramid service.
it is currently being used to maintain long-term access to systems before selling that entry to major ransomware groups like RansomHub.
Technique - T1571 Non-Standard Port Description : Uses port 443 to blend with legitimate HTTPS traffic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor reported as abusing Python site hooks to import and trigger DLL execution for persistent code execution.
A backdoor reported as abusing Python site hooks to import and trigger DLL execution for persistent payload execution.
Python-based backdoor that persists via a scheduled task, abuses sitecustomize.py to load an obfuscated DLL, decrypts and executes a multi-stage payload, and establishes a SOCKS5 proxy/tunnel to a hard-coded C2 server over port 443.
Python-based backdoor used to establish long-term access. It leverages sitecustomize.py for automatic code execution, is disguised as a DLL, uses heavy obfuscation and layered encryption, and establishes a SOCKS5 proxy on port 443 to conceal traffic and support covert access/exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.