Loading malware…
VIPERTUNNEL is a Python-based Windows backdoor that establishes persistent access through a scheduled task and abuse of Python's automatically loaded sitecustomize hook. It uses an obfuscated Python payload masquerading as a DLL, decrypts and executes staged code in memory, and creates an outbound SOCKS5 tunnel over port 443. Its proxy components relay command-and-control-directed traffic into the victim environment, enabling concealed remote access and network pivoting. VIPERTUNNEL has been observed in UK and US business environments, including as a follow-on payload after SocGholish/FAKEUPDATES infections, and has been used to maintain access preceding ransomware activity. The malware employs layered encoding, compression, encryption, and control-flow obfuscation to hinder analysis.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The report details the analysis of VIPERTUNNEL, a Python based backdoor that achieves persistence via a scheduled task and leverages a malicious sitecustomize.py to load an obfuscated DLL.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Technique - T1053.005 Scheduled Task : Persistence Description : Creates or modifies a scheduled task to execute malicious code at system boot or on a schedule.
The file b5yogiiy3c.dll is an python script... The payload is processed with compile() , using a synthetic filename... and exec mode, then executed immediately... Pyramid ... evades EDR detection by using the LOLBin python.exe to run Python code in memory.
They found that the attackers were using a clever trick involving a file named sitecustomize.py located in C:\ProgramData\cp49s\Lib\ . This is a standard Python module, but because it loads automatically when the interpreter starts, it allows hackers to run their code without any manual input.
Technique - T1053.005 Scheduled Task : Persistence Description : Creates or modifies a scheduled task to execute malicious code at system boot or on a schedule.
Python's site module loads these hooks from directories on sys.path before Python is executed. If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
Technique - T1053.005 Scheduled Task : Persistence Description : Creates or modifies a scheduled task to execute malicious code at system boot or on a schedule.
Python's site module loads these hooks from directories on sys.path before Python is executed. If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
Technique - T1027 Obfuscated Files or Information Description : Uses encoding, compression and cryptographic primitives to hide malicious code.
Technique - T1027.004 Compile After Delivery Description : Compiles recovered code in memory using compile() and exec().
Disguised as a DLL file, the malware's code is heavily obfuscated using multiple encryption layers...
Technique - T1140 Deobfuscate/Decode Files or Information Description : Decodes Base85 and other transformations to recover next-stage code.
They found that the attackers were using a clever trick involving a file named sitecustomize.py located in C:\ProgramData\cp49s\Lib\ . This is a standard Python module, but because it loads automatically when the interpreter starts, it allows hackers to run their code without any manual input.
The proxy uses port 443 for outbound connections, blending with typical HTTPS traffic to evade detection.
It establishes a SOCKS5 proxy on port 443, mimicking legitimate web traffic to conceal data exfiltration.
Technique - T1090.001 Proxy Internal Proxy Description : Uses internal proxy components to relay traffic.
Technique - T1090.002 Proxy External Proxy Description : Establishes an external SOCKS5 proxy to forward traffic.
Technique - T1102 Web Service Description : Communicates with C2 over HTTPS using custom Pyramid service.
it is currently being used to maintain long-term access to systems before selling that entry to major ransomware groups like RansomHub.
Technique - T1571 Non-Standard Port Description : Uses port 443 to blend with legitimate HTTPS traffic.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor referenced as using manipulated Python site hook files to hijack the Python environment and establish persistence.
A backdoor reported to abuse Python site hook files to import and trigger DLL execution, enabling payload execution whenever Python is invoked.
Backdoor reported as abusing Python site hooks to import and trigger DLL execution for persistent code execution.
A backdoor reported as abusing Python site hooks to import and trigger DLL execution for persistent payload execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.