ViperTunnel Backdoor Gives Ransomware Brokers Stealthy Access to UK and US Firms
Malware Intelligence · 2 sources · Updated 4mo ago · First seen Apr 14, 2026
Researchers at InfoGuard identified a new Python-based backdoor, ViperTunnel, inside UK and US business networks, where it appears to provide persistent access that can later be sold or handed off to ransomware operators including RansomHub. The malware was uncovered during incident response to a DragonForce ransomware attack and is frequently seen after FAKEUPDATES (SocGholish) infections. Reporting also says ViperTunnel is often used alongside the ShadowCoil credential stealer, strengthening its role in broader intrusion chains that move from initial compromise to credential theft and eventual ransomware deployment.
ViperTunnel disguises itself as a DLL but is actually a heavily obfuscated Python script that abuses Python's sitecustomize.py auto-loading mechanism for execution and persistence, including via suspicious Windows scheduled tasks. It establishes a SOCKS5 proxy over port 443 to blend malicious traffic with normal web activity, while layered obfuscation and encryption hinder analysis. InfoGuard said the malware has evolved from error-filled early builds into a more modular framework and assessed it is likely linked to UNC2165, a cluster associated with EvilCorp; researchers also found Linux anti-debugging artifacts, including a TracerPid check, indicating the operators may be preparing a future cross-platform version targeting Linux systems.
