Loading malware…
TunnesshClient is a PyInstaller-packaged backdoor used as an auxiliary payload in financially motivated malware campaigns that distribute information stealers through fake software-download lures and brand-impersonation GitHub repositories. It has been observed alongside BoryptGrab, Vidar variants, and the HeaconLoad loader in multi-stage Windows intrusion chains that rely on social engineering and malicious download pages rather than exploitation of a software vulnerability.
Its core function is to establish a reverse SSH tunnel from an infected host to attacker-controlled infrastructure, giving operators persistent remote access into the victim environment and enabling traffic relay through the compromised system. TunnesshClient has also been described as acting as a SOCKS5 proxy, allowing attackers to route follow-on activity through the victim machine. Reported operator use includes remote command execution, file movement, and proxying, making it a flexible post-compromise access tool rather than a primary theft payload.
Observed delivery occurs as part of bundled malware packages obtained from deceptive ZIP archives masquerading as legitimate software or game-related downloads. In the broader campaign, initial execution has involved DLL side-loading and downloader components that retrieve additional payloads, after which TunnesshClient may be deployed selectively. Available reporting supports Windows as the relevant target platform in these operations. Infrastructure artifacts and campaign context have suggested possible Russian-origin operators, but no definitive public attribution to a specific threat actor is established.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious PyInstaller reverse-SSH backdoor mentioned as a secondary payload in earlier BoryptGrab-related reporting, not the primary malware in this campaign.
Backdoor enabling reverse SSH tunneling and SOCKS5 proxying for attacker communications and pivoting.
PyInstaller-based backdoor that establishes a reverse SSH tunnel, enabling remote command execution, file movement, and use of the victim host as a proxy.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.