PYTRIC

PYTRIC is a PyInstaller-packed Python implant associated with the Operation IconCat campaign, tracked by Seqrite Labs as UNG0801, targeting Israeli organizations since November 2025. It was delivered in a campaign that abused Check Point branding and antivirus icon spoofing to appear legitimate, including a malicious PDF lure such as help.pdf that instructed victims to download a fake "Security Scanner" from Dropbox, reportedly protected by the password "cloudstar." The malware is assessed as destructive rather than stealth-focused. Reported capabilities include scanning the file system across the entire system, checking for administrator privileges, wiping system information or system data, performing a system-wide wipe, and deleting backups. PYTRIC also supports remote control through a Telegram bot identified as Backup2040. The campaign used Hebrew-language phishing and targeted Israeli organizations, including entities in IT, staffing/HR, software development, and other sectors. It has been publicly linked in reporting to MuddyWater-related activity, though definitive attribution for Operation IconCat itself was described as uncertain or elusive. Reported indicators and related artifacts in the provided content include the malware name PYTRIC, the Telegram bot name Backup2040, the lure file help.pdf, the fake downloaded tool name "Security Scanner," Dropbox as a payload host, and broader campaign infrastructure references such as netvigil.org.