VIPERTUNNEL Python Backdoor Uses Obfuscated DLLs to Build SOCKS5 Tunnels

Researchers detailed VIPERTUNNEL, a Python-based backdoor delivered as an obfuscated file masquerading as a DLL and loaded through a malicious sitecustomize.py, with persistence established via a scheduled task. After multiple layers of encoding, compression, and decryption are removed, the payload resolves into a SOCKS5 proxy backdoor that connects outbound to a hardcoded command-and-control server over port 443, authenticates with embedded credentials, and relays traffic into the victim's local network through threaded proxy components.

Analysis of samples from late 2023 through late 2025 shows the malware evolving from unstable development builds into a more mature, stealth-focused variant. Investigators linked the infrastructure to Pyramid C2 servers that frequently expose an HTTP 401 response with a distinctive Basic realm="Proxy" header and often use ports 22, 443, and sometimes 8000; the activity has also been associated in reporting with UNC2165/EvilCorp and shares obfuscation traits with the ShadowCoil credential stealer. Defenders were advised to watch for pythonw.exe launched without arguments, suspicious numeric scheduled tasks, unexpected sitecustomize.py files, and unusual outbound proxy traffic patterns.