Loading story…
Researchers linked the Vatet loader, PyXie RAT, and Defray777 ransomware to the same financially motivated threat actor through shared development artifacts, including overlapping PDB paths, similar string-encryption routines, mutex logic, and ties to a Cobalt Mode downloader and Cobalt Strike delivery. The group has reportedly operated since 2018 and targeted organizations in healthcare, education, government, and technology, using a staged intrusion chain in which Vatet loads PyXie for reconnaissance and theft before Defray777—also known as RansomX—is deployed in memory to encrypt files.
An updated malware variant dubbed PyXie Lite shows the group refining that playbook with a smaller, repurposed implant focused on reconnaissance, credential theft, file collection, and exfiltration. Loaded by Vatet through a multi-stage in-memory chain, PyXie Lite uses a hardened custom Python interpreter with remapped opcodes and stores final-stage bytecode in an encrypted ZIP imported from memory; it collects system details, passwords, cookies, screenshots, PowerShell history, registry hives, and files matching espionage- and finance-related keywords, while also invoking tools such as Mimikatz and LaZagne. Staged data is compressed and encrypted with AES-CBC before exfiltration to configured servers, including compromised internal victim-network hosts listening on ports 31337, 900, and 8443.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported that the financially motivated threat group behind Vatet, PyXie, and Defray777 had been active since 2018. The group was described as targeting organizations in healthcare, education, government, and technology.
Unit 42 reported that the threat actors ported Defray777 from Windows to Linux. The report described Defray777 as the first targeted ransomware family in this context to have standalone executables for both operating systems.
Researchers exploited a search order hijacking weakness in the custom interpreter used by PyXie Lite to gain control of execution, disable anti-analysis behavior, generate bytecode, and recover remapped opcodes. This allowed them to dump the malware's configuration and further analyze its final-stage Python payloads.
Unit 42 documented an updated PyXie variant dubbed PyXie Lite that had been repurposed for reconnaissance, credential theft, file collection, and data exfiltration. The sample they analyzed was loaded by Vatet and used a multi-stage in-memory execution chain with a hardened custom Python interpreter.
Unit 42 published analysis concluding that Vatet, PyXie, and Defray777 were likely created and maintained by the same threat group. The attribution was based on shared development artifacts, overlapping PDB paths, similar string-encryption routines, and related mutex logic.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourcesecureworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 detailed a stealth-focused intrusion toolkit built around **PyXie**, **PyXie Lite**, **Vatet**, and **Defray777**, alongside associated **Cobalt Strike** command-and-control infrastructure. The malware set supports multi-stage post-compromise activity, including host reconnaissance, credential and document theft, screenshot capture, software and registry discovery, administrative group enumeration, network configuration collection, and port scanning, indicating an operation designed to map victim environments before follow-on action. The reported artifacts show payload staging under Windows system paths and network-share locations, with numerous SHA-256 hashes, C2 IPs, domains, execution arguments, and payload paths tied to the activity. Unit 42 said **PyXie Lite** was configured to collect files matching sensitive business, infrastructure, financial, and cryptocurrency-related patterns, while **Vatet** samples used masquerading themes and embedded PDB paths referencing tools and components such as Rainmeter, Notepad++, Notepad, TetrisGame, Cobalt Strike mode, and ransomware, suggesting a mature ecosystem capable of broad discovery, exfiltration, and likely follow-on ransomware or destructive operations.
Aug 14, 2026
Palo Alto Networks Unit 42 reported on threat activity involving the **Vatet**, **PyXie**, and **Defray777** malware families, describing campaigns designed to operate with a low profile and avoid traditional detection. The reporting links these tools to intrusion activity in which attackers relied on stealthy execution and carefully staged malware components to remain under the radar while maintaining access to compromised environments. The malware set spans multiple functions, combining backdoor-style access and follow-on payload delivery with the **Defray777** ransomware family. Unit 42 highlighted how the operators used these tools as part of broader intrusion chains rather than isolated malware incidents, underscoring the risk that seemingly quiet compromises can progress into disruptive ransomware deployment if defenders do not detect the earlier stages of activity.
Jul 12, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026