MalwareUsed by 1 actor

IronNetInjector

IronNetInjector is a Turla-associated malware loading toolchain identified by Palo Alto Networks Unit 42 in 2021. It uses a Bring Your Own Interpreter (BYOI) approach in which obfuscated IronPython scripts decrypt and load an embedded .NET injector, internally referred to as NetInjector or PeInjector_x64, along with one or more encrypted payloads. The scripts take a command-line decryption key, use Base64 and Rijndael/RijndaelManaged to decrypt embedded components, and then load the injector into the IronPython process via .NET reflection using Assembly.Load(). The injector can inject payloads into its own process or into remote processes, including explorer.exe, and can inject DLLs into running processes. Unit 42 reported that the toolchain was mostly used to load ComRAT payloads, with one observed case using a Turla RPC backdoor variant and another using an unidentified payload. The injectors support reflective PE injection of native x86/x64 payloads into remote processes; the newer 2019 variant can also inject .NET assemblies into unmanaged processes and load payloads directly into the IronPython interpreter process. Observed persistence/execution artifacts included a Windows Scheduled Task XML file named mssch.xml with the description or disguised service name PythonUpdateSrvc, configured to run an IronPython script at startup, user logon, or on specific Microsoft-Windows-GroupPolicy/Operational event triggers. Reported logging artifacts included %PUBLIC%\Metadata.dat for log messages and %PUBLIC%\Metaclass.dat for errors. A 7-Zip archive named IronPython-2.7.7z was observed containing a portable IronPython distribution, two IronPython scripts, and the scheduled task XML. High-confidence indicators mentioned in the reporting include script SHA256 3aa37559ef282ee3ee67c4a61ce4786e38d5bbe19bdcbeae0ef504d79be752b6, injector SHA256 a56f69726a237455bac4c9ac7a20398ba1f50d2895e5b0a8ac7f1cdb288c32cc, and ComRAT payload SHA256 a62e1a866bc248398b6abe48fdb44f482f91d19ccd52d9447cda9bc074617d56.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Turla

2021-02-19 ⋅ Palo Alto Networks Unit 42 IronNetInjector: Turla’s New Malware Loading Tool Agent.BTZ IronNetInjector TurlaRPC

via malpediamalpedia.caad.fkie.fraunhofer.de

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053Scheduled Task/JobEvidence1

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

T1053.005Scheduled TaskEvidence2

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence2

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence2

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

T1055Process InjectionEvidence4

The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

T1027.013Encrypted/Encoded FileEvidence1

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

T1055Process InjectionEvidence4

T1140Deobfuscate/Decode Files or InformationEvidence4

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

Discovery

1 technique

T1057Process DiscoveryEvidence2

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

2021-02-19 ⋅ Palo Alto Networks Unit 42 ⋅ IronNetInjector: Turla’s New Malware Loading Tool

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

malpediaNews

May 14, 2026

Turla (Threat Actor)

A malware loading tool used by Turla to load or deploy other payloads.

mitre attack websiteNews

Apr 25, 2023

Process Injection, Technique T1055 - Enterprise | MITRE ATT&CK®

Injector malware/tool that uses IronPython and a .NET injector to inject payloads into local or remote processes.

palo alto networks unit 42 blogNews

Feb 19, 2021

IronNetInjector: Turla’s New Malware Loading Tool

A Turla-associated BYOI (Bring Your Own Interpreter) toolchain using malicious IronPython scripts to decrypt and load an embedded .NET process injector, which then reflectively injects embedded payloads (native PE or .NET assemblies) into the IronPython process or a remote process (commonly explorer.exe).

mitre attack websiteNews

Nov 19, 2019

Scheduled Task/Job: Scheduled Task, Sub-technique T1053.005 - Enterprise | MITRE ATT&CK®

Injector malware that uses task XML to run scripts on logon or system events.

+6 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

IronNetInjector