Pupy RAT
Pupy RAT is an open-source, Python-based remote access trojan/backdoor that provides attackers with full access to infected systems. The content describes it as a commodity RAT and notes capabilities including opening a backdoor, executing commands, stealing data, installing additional malware, moving laterally, downloading additional modules after execution, and using reflective DLL loading to evade detection. One cited campaign used phishing emails with ISO attachments containing a legitimate Microsoft-signed WerFault.exe, a malicious faultrep.dll, a decoy XLS file, and a shortcut that invoked scriptrunner.exe; through DLL sideloading, WerFault.exe loaded the malicious faultrep.dll, which created one thread to load the Pupy RAT DLL payload dll_pupyx64.dll into memory and another to open the XLS decoy. The use of WerFault.exe and sideloading was intended to reduce security alerts. The campaign was not conclusively attributed, though researchers assessed the operators were likely based in China. The malware has also been used by state-backed espionage actors including APT33/Elfin and APT35. Reported targeting associated with APT33 included government and private-sector organizations across sectors such as chemical, engineering, research, finance, telecoms, healthcare, manufacturing, IT, and energy consultancy, with victims in Saudi Arabia, the United States, and other countries. The content also notes Pupy RAT has used virtual machine fingerprinting techniques.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Pupy RAT (Backdoor.Patpoopy): Commodity RAT that can open a backdoor on an infected computer.
When the DLL is loaded in this attack, it will create two threads, one that loads Pupy Remote Access Trojan's DLL ('dll_pupyx64.dll') into memory and one that opens the included XLS spreadsheet to serve as a decoy.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueThe malware campaign starts with the arrival of an email with an ISO attachment.
Execution
2 techniquesThe victim starts the infection chain by clicking on the shortcut file, which uses 'scriptrunner.exe' to execute WerFault.exe.
When double-clicked, the ISO will mount itself as a new drive letter... The victim starts the infection chain by clicking on the shortcut file...
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
3 techniquesThe use of this Windows executable is to stealthy infect devices without raising any alarms on the breached system by launching the malware through a legitimate Windows executable.
"Virtual Machine Fingerprinting... used by the Pupy RAT" / "Windows Sandbox with Sensitive Configuration"
Pupy RAT is an open-source and publicly available malware written in Python that supports reflective DLL loading to evade detection...
Discovery
1 techniqueLateral Movement
1 techniqueThe malware allows threat actors to gain full access to the infected devices, enabling them to execute commands, steal data, install further malware, or spread laterally through a network.
Command and Control
2 techniquesPupy RAT is an open-source and publicly available malware written in Python that supports reflective DLL loading to evade detection, and additional modules are downloaded later.
In addition to its custom malware, Elfin has also used a number of commodity malware tools... Remcos... DarkComet... Quasar RAT... Pupy RAT... NanoCore... NetWeird...
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An open-source Python-based remote access trojan that supports reflective DLL loading to evade detection and can download additional modules. It gives attackers full access to infected devices, enabling command execution, data theft, further malware installation, and lateral movement.
Commodity RAT used by Elfin to establish backdoor access on compromised systems.
Remote Access Trojan (RAT) referenced as having used virtual machine fingerprinting techniques to identify virtualized environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.