Loading story…
Researchers observed a new Python-based ransomware attack aimed at misconfigured, internet-exposed Jupyter Notebook environments, marking an unusual shift from the cryptojacking activity more commonly seen against these systems. In Aqua Security's honeypot, an attacker accessed an exposed Jupyter instance, opened a terminal session, downloaded malicious tools, and manually assembled a ransomware script designed to copy and encrypt files, delete the original unencrypted data, and then remove itself to reduce forensic evidence.
The attack did not fully complete in the monitored environment, and no ransom note was recovered, suggesting the operator may have been testing tooling or was interrupted during execution. Researchers said artifacts from the intrusion indicate the actor may be linked to earlier campaigns targeting Jupyter servers for illicit cryptocurrency mining and may be Russian-speaking, underscoring the risk that poorly secured notebook servers can be turned into high-impact ransomware targets if they are exposed to the internet without hardening and reliable backups.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Aqua Security's Team Nautilus observed a new Python-based ransomware strain targeting a misconfigured, internet-exposed Jupyter Notebook instance in a honeypot. The attacker accessed the environment, opened a terminal, downloaded tools, and manually created a Python ransomware script, but the attack did not fully complete and no ransom note was recovered.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wave of sophisticated Python-based malware and stealer campaigns has been observed, leveraging advanced evasion techniques and targeting a wide range of platforms. Notable threats include a Python malware that hides within PNG-disguised RAR files and injects payloads into legitimate executables, as well as the Xillen Stealer v4, which employs polymorphic evasion to target over 100 browsers and 70 cryptocurrency wallets, including DevOps environments. Other campaigns involve the Eternidade Stealer, a Python WhatsApp worm using IMAP email for covert command and control and deploying overlays to target Brazilian banking users, and a multi-layer Python RAT distributed via PyPI typosquatting, which bypasses scanners using XOR encryption. Additionally, attackers are exploiting messaging platforms such as WhatsApp with sophisticated worms that hijack sessions and deploy banking trojans like Astaroth. Another campaign involves a trojanized VPN installer that delivers the NKNShell backdoor, utilizing P2P blockchain and MQTT protocols for covert C2 communications. These incidents highlight the increasing complexity and diversity of Python-based malware, the use of novel distribution and evasion tactics, and the growing risk to both individual users and enterprise environments across multiple vectors, including messaging apps, software supply chains, and browser extensions.
Jun 29, 2026
U.S. and European authorities warned that the **PYSA** ransomware group, also tracked as **Mespinoza**, was conducting double-extortion attacks against education and government organizations after stealing data and then encrypting Windows and Linux systems. The FBI said incidents affected higher education, K-12 schools, and seminaries across 12 U.S. states and the United Kingdom, while France's CERT-FR reported related intrusions against local government authorities. Stolen information included employment records, personally identifiable information, and payroll tax data, with victims pressured through ransom notes and threats to publish data on Tor-based leak sites. Investigations and technical analyses showed the operators commonly gained initial access through compromised or brute-forced **RDP** credentials and phishing, then expanded access with reconnaissance and post-exploitation tools including **Advanced IP Scanner**, **Advanced Port Scanner**, **PowerShell Empire**, **Koadic**, **Mimikatz**, **PsExec**, **Cobalt Strike**, **WinSCP**, **Chisel**, and **MEGA**. The malware appended extensions such as `.pysa`, `.locked`, and `.newversion`, used AES encryption with RSA-protected keys, terminated services and security tools to improve encryption success, and in some cases changed local account passwords or modified Windows legal notice settings to display ransom demands. Researchers and law enforcement said the campaign disproportionately targeted high-value organizations, especially education, healthcare, and government entities, and urged mitigations including MFA, RDP hardening, segmentation, patching, least privilege, backups, and user awareness training.
Aug 15, 2026
Attackers used a custom Python ransomware script to encrypt virtual disks on a VMware ESXi hypervisor, taking the victim organization’s virtual machines offline after gaining access through a TeamViewer account that lacked multi-factor authentication on a system used by a Domain Administrator. Sophos said the intrusion moved from initial access to ransomware deployment in just over three hours, with the attackers scanning the network using Advanced IP Scanner and reaching the ESXi server through Bitvise after finding ESXi Shell enabled. The script, `fcker.py`, was copied to the hypervisor and executed against multiple datastores, where it shut down VMs, encrypted datastore files with OpenSSL using per-file AES material, overwrote the originals, and tried to remove evidence. Sophos identified the malware as **Troj/Ransom-GJR** and reported that it generated unique key pairs for each datastore run, leaving encrypted private keys on disk because it had no built-in exfiltration capability; the company urged organizations to harden ESXi, disable ESXi Shell when not required, and enforce MFA on privileged remote-access accounts.
Aug 14, 2026