MalwareUsed by 2 actors

sysmon

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TeamPCP

After exfiltration, the harvester drops a polling backdoor to ~/.config/sysmon/sysmon.py and registers it as a systemd user service (sysmon.service). The backdoor checks https://checkmarx.zone/raw every 50 minutes for a URL, downloads whatever binary it points to, writes it to /tmp/pglog, and executes it.

via mend io blogmend.io

APT38

"Malware associated with BlueNorOff include: \"... sysmon ...\""

via wikipedia cyber incidentsen.wikipedia.org

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Process execution: what command ran, with what arguments, spawned by what parent, needs Sysmon... The cheapest possible end-to-end test: run ‘whoami’ in PowerShell on DC02, then go looking for it...

Persistence

2 techniques

T1543Create or Modify System ProcessEvidence1

Figure 4 shows code written to the filepath /host/root/.config/sysmon/sysmon.py ... Beyond stealing credentials and achieving persistence, the threat actors also masqueraded their activity as legitimate services like systemd

T1543.002Systemd ServiceEvidence1

The persistence dropper is installed at ~/.config/sysmon/sysmon.py with a corresponding systemd unit at ~/.config/systemd/user/sysmon.service (service name: "System Telemetry Service").

Privilege Escalation

2 techniques

T1543Create or Modify System ProcessEvidence1

T1543.002Systemd ServiceEvidence1

The persistence dropper is installed at ~/.config/sysmon/sysmon.py with a corresponding systemd unit at ~/.config/systemd/user/sysmon.service (service name: "System Telemetry Service").

Stealth

1 technique

T1218System Binary Proxy ExecutionEvidence1

Originally, the tool looked for a minifilter sitting at altitude 385201 with the name “SysmonDrv”, Sysmon’s default, and would unload it.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

it enters a loop that polls https://checkmarx.zone/raw every 50 minutes... POSTs it to https[://]models[.]litellm[.]cloud/

T1105Ingress Tool TransferEvidence1

Each cycle fetches a URL from the C2... If the URL is new and the kill switch is not engaged, the dropper downloads the binary to /tmp/pglog, makes it executable, and runs it in a detached session.

Other

1 technique

T1562Impair DefensesEvidence2

Originally, the tool looked for a minifilter sitting at altitude 385201 with the name “SysmonDrv”, Sysmon’s default, and would unload it.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

mend io blogNews

Mar 24, 2026

LiteLLM PyPI Compromise: TeamPCP Credential Stealer

A persistent polling backdoor dropped after credential theft. It installs as a systemd user service, periodically retrieves a payload URL from C2, downloads a binary to /tmp/pglog, and executes it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 2 actors

sysmon

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TeamPCP

via mend io blogmend.io

APT38

"Malware associated with BlueNorOff include: \"... sysmon ...\""

via wikipedia cyber incidentsen.wikipedia.org

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Persistence

2 techniques

T1543Create or Modify System ProcessEvidence1

T1543.002Systemd ServiceEvidence1

The persistence dropper is installed at ~/.config/sysmon/sysmon.py with a corresponding systemd unit at ~/.config/systemd/user/sysmon.service (service name: "System Telemetry Service").

Privilege Escalation

2 techniques

T1543Create or Modify System ProcessEvidence1

T1543.002Systemd ServiceEvidence1

The persistence dropper is installed at ~/.config/sysmon/sysmon.py with a corresponding systemd unit at ~/.config/systemd/user/sysmon.service (service name: "System Telemetry Service").

Stealth

1 technique

T1218System Binary Proxy ExecutionEvidence1

Originally, the tool looked for a minifilter sitting at altitude 385201 with the name “SysmonDrv”, Sysmon’s default, and would unload it.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

it enters a loop that polls https://checkmarx.zone/raw every 50 minutes... POSTs it to https[://]models[.]litellm[.]cloud/

T1105Ingress Tool TransferEvidence1

Each cycle fetches a URL from the C2... If the URL is new and the kill switch is not engaged, the dropper downloads the binary to /tmp/pglog, makes it executable, and runs it in a detached session.

Other

1 technique

T1562Impair DefensesEvidence2

Originally, the tool looked for a minifilter sitting at altitude 385201 with the name “SysmonDrv”, Sysmon’s default, and would unload it.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

mend io blogNews

Mar 24, 2026

LiteLLM PyPI Compromise: TeamPCP Credential Stealer

A persistent polling backdoor dropped after credential theft. It installs as a systemd user service, periodically retrieves a payload URL from C2, downloads a binary to /tmp/pglog, and executes it.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.