MalwareUsed by 1 actor

ShadowPy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BRONZE BUTLER

BRONZE BUTLER ... Tools ... ABK, BBK, Casper, Daserf, Datper, DGet, down_new, Ghostdown, Gofarer, gsecdump, Mimikatz, MSGet, Netboy, RarStar, Screen Capture Tool, ShadowPad, ShadowPy, T-SMB

via secureworkssecureworks.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

the threat actor breached the DLP company’s internal update servers to deliver malware within its network. It then trojanized legitimate tool installers used by the firm, leading to malware being executed on two of its customers’ computers.

T1195.002Compromise Software Supply ChainEvidence2

Tick compromised update servers to deliver malicious update packages via the software developed by the compromised company.

Execution

1 technique

T1059.006PythonEvidence2

ShadowPy malware uses a downloader written in Python.

Persistence

2 techniques

T1543.003Windows ServiceEvidence1

Netboy and ShadowPy loaders persist by creating a service.

T1547.001Registry Run Keys / Startup FolderEvidence1

Netboy and ShadowPy loaders persist via a Run key.

Privilege Escalation

4 techniques

T1055.002Portable Executable InjectionEvidence1

Netboy and ShadowPy loaders inject a PE into a preconfigured system process.

T1055.003Thread Execution HijackingEvidence1

Netboy and ShadowPy loaders hijack the main thread of the system process to transfer execution to the injected malware.

T1543.003Windows ServiceEvidence1

Netboy and ShadowPy loaders persist by creating a service.

T1547.001Registry Run Keys / Startup FolderEvidence1

Netboy and ShadowPy loaders persist via a Run key.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

Netboy, ShadowPy, and their loader use encrypted: payloads, strings, configuration. Loaders contain garbage code.

T1027.001Binary PaddingEvidence1

Netboy and ShadowPy loaders DLLs are padded to avoid security solutions from uploading samples.

T1036.004Masquerade Task or ServiceEvidence1

Netboy and ShadowPy loaders use legitimate service and description names when creating services.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Netboy and ShadowPy loaders use legitimate service and description names when creating services.

T1055.002Portable Executable InjectionEvidence1

Netboy and ShadowPy loaders inject a PE into a preconfigured system process.

T1055.003Thread Execution HijackingEvidence1

Netboy and ShadowPy loaders hijack the main thread of the system process to transfer execution to the injected malware.

Defense Impairment

1 technique

T1553.001Gatekeeper BypassEvidence1

weeks later began introducing trojanized copies of the Q-Dir installers.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

Netboy and ReVBShell, gather user information.

T1082System Information DiscoveryEvidence1

Netboy and ReVBShell, gather system information.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

ShadowPy and ReVBShell communicate via HTTP protocol with their C&C server.

T1105Ingress Tool TransferEvidence1

During the intrusion, the attackers deployed a previously undocumented downloader named ShadowPy, and they also deployed the Netboy backdoor (aka Invader) and Ghostdown downloader

T1573Encrypted ChannelEvidence1

Netboy uses RC4. ShadowPy uses AES.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

domain●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

secureworksNews

Jan 1, 2026

Cyber Threat Group Profiles: Their Objectives, Aliases, and Malware Tools | Sophos

Listed as a tool used by the BRONZE BUTLER threat profile.

infosecurity magazine comNews

Mar 15, 2023

Tick APT Group Hacked East Asian DLP Software Firm

A previously undocumented downloader deployed by Tick during the intrusion into the East Asian DLP software company.

eset welivesecurity blogNews

Mar 14, 2023

The slow Tick-ing time bomb: Tick APT group compromise of a DLP software developer in East Asia

A previously undocumented Python-based downloader converted into a Windows executable using a customized py2exe loader. It contacts C2 infrastructure to retrieve Python scripts, decrypts and decompresses them, and executes them in a new thread. It was delivered via DLL side-loading and injected into svchost.exe for persistence and execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

ShadowPy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BRONZE BUTLER

BRONZE BUTLER ... Tools ... ABK, BBK, Casper, Daserf, Datper, DGet, down_new, Ghostdown, Gofarer, gsecdump, Mimikatz, MSGet, Netboy, RarStar, Screen Capture Tool, ShadowPad, ShadowPy, T-SMB

via secureworkssecureworks.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

T1195.002Compromise Software Supply ChainEvidence2

Tick compromised update servers to deliver malicious update packages via the software developed by the compromised company.

Execution

1 technique

T1059.006PythonEvidence2

ShadowPy malware uses a downloader written in Python.

Persistence

2 techniques

T1543.003Windows ServiceEvidence1

Netboy and ShadowPy loaders persist by creating a service.

T1547.001Registry Run Keys / Startup FolderEvidence1

Netboy and ShadowPy loaders persist via a Run key.

Privilege Escalation

4 techniques

T1055.002Portable Executable InjectionEvidence1

Netboy and ShadowPy loaders inject a PE into a preconfigured system process.

T1055.003Thread Execution HijackingEvidence1

Netboy and ShadowPy loaders hijack the main thread of the system process to transfer execution to the injected malware.

T1543.003Windows ServiceEvidence1

Netboy and ShadowPy loaders persist by creating a service.

T1547.001Registry Run Keys / Startup FolderEvidence1

Netboy and ShadowPy loaders persist via a Run key.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

Netboy, ShadowPy, and their loader use encrypted: payloads, strings, configuration. Loaders contain garbage code.

T1027.001Binary PaddingEvidence1

Netboy and ShadowPy loaders DLLs are padded to avoid security solutions from uploading samples.

T1036.004Masquerade Task or ServiceEvidence1

Netboy and ShadowPy loaders use legitimate service and description names when creating services.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Netboy and ShadowPy loaders use legitimate service and description names when creating services.

T1055.002Portable Executable InjectionEvidence1

Netboy and ShadowPy loaders inject a PE into a preconfigured system process.

T1055.003Thread Execution HijackingEvidence1

Netboy and ShadowPy loaders hijack the main thread of the system process to transfer execution to the injected malware.

Defense Impairment

1 technique

T1553.001Gatekeeper BypassEvidence1

weeks later began introducing trojanized copies of the Q-Dir installers.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

Netboy and ReVBShell, gather user information.

T1082System Information DiscoveryEvidence1

Netboy and ReVBShell, gather system information.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

ShadowPy and ReVBShell communicate via HTTP protocol with their C&C server.

T1105Ingress Tool TransferEvidence1

During the intrusion, the attackers deployed a previously undocumented downloader named ShadowPy, and they also deployed the Netboy backdoor (aka Invader) and Ghostdown downloader

T1573Encrypted ChannelEvidence1

Netboy uses RC4. ShadowPy uses AES.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

domain●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

secureworksNews

Jan 1, 2026

Cyber Threat Group Profiles: Their Objectives, Aliases, and Malware Tools | Sophos

Listed as a tool used by the BRONZE BUTLER threat profile.

infosecurity magazine comNews

Mar 15, 2023

Tick APT Group Hacked East Asian DLP Software Firm

A previously undocumented downloader deployed by Tick during the intrusion into the East Asian DLP software company.

eset welivesecurity blogNews

Mar 14, 2023

The slow Tick-ing time bomb: Tick APT group compromise of a DLP software developer in East Asia

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.