Loading story…
Splunk Enterprise Security released analytics to detect malicious Python package installations that execute attacker code during installation or persist through Python startup mechanisms. The coverage flags abuse of setup.py, distutils/setuptools command classes, .pth files, sitecustomize.py, usercustomize.py, and PYTHONPATH; these techniques can execute arbitrary code during package installation or whenever a user later starts Python. The detections were informed by TeamPCP's compromise of the litellm package, which used .pth-based persistence, and VIPERTUNNEL's abuse of Python site hooks.
The endpoint analytics correlate Sysmon process-creation and file-creation events to identify .pth files created in site-packages or dist-packages, and correlate Sysmon Event IDs 1 and 13 to identify PYTHONPATH registry changes associated with pip and site-package activity. A malicious PYTHONPATH can redirect imports to attacker-controlled directories, analogous to PATH-search-order hijacking in which a malicious executable is resolved before the legitimate one. Security teams should enable the required Sysmon and CIM telemetry, investigate anomalous package-install activity and environment-variable changes, and tune for legitimate editable installs, namespace packages, developer workflows, and installer configuration changes.
See real exploitation activity before you spend the cycle.
19 events from the most recent confirmed update back to the earliest known activity.
Splunk Enterprise Security updated its anomaly detection for outbound network connections made by Python processes during package builds or installations. The analytic uses Sysmon process-creation and network-connection telemetry to identify potential malicious setup.py-driven beacons associated with software supply-chain compromise.
Splunk Enterprise Security updated its TTP analytic for PYTHONPATH registry modifications associated with Python package installation, using Sysmon process and registry telemetry.
Splunk Enterprise Security updated its anomaly detection for Python .pth file creation during package installation, correlating Sysmon process-creation and file-creation telemetry.
Splunk Enterprise Security updated its Malicious Python Package Installation analytic story, covering install-time code execution and persistence through .pth files, site hooks, and PYTHONPATH manipulation.
The VIPERTUNNEL backdoor was associated with abuse of Python sitecustomize.py or usercustomize.py hooks to establish persistence.
TeamPCP used Python .pth-based persistence during its supply-chain compromise of the litellm package.
Threat Group-3390 compromised the Able Desktop installer to gain access to victim environments.
During the SolarWinds compromise, SUNSPOT was used to insert SUNBURST into SolarWinds Orion builds, and APT29 gained initial network access to some victims through trojanized Orion updates.
Sandworm Team replaced a legitimate update for Ukrainian accounting software M.E.Doc with a malicious update to spread NotPetya.
Moonstone Sleet distributed a trojanized version of PuTTY to gain initial access to victims.
GoldenSpy was packaged with legitimate tax-preparation software for distribution to users.
GOLD SOUTHFIELD distributed ransomware by backdooring software installers after strategically compromising the website hosting Italian WinRAR.
FIN7 gained initial access to victim environments by compromising a victim's software supply chain.
Dragonfly placed trojanized installers for control-system software in legitimate vendor application stores.
Daggerfly was associated with supply-chain compromises that used malicious updates to compromise victims.
Cobalt Group compromised legitimate web-browser updates to deliver a backdoor.
CCBkdr was added to a legitimate signed version 5.33 of CCleaner and distributed through CCleaner's distribution site.
APT41 accessed production environments and injected malicious code into legitimate signed files that were then widely distributed to end users.
During the 3CX supply-chain attack, AppleJeus first compromised an end-of-life trading application executed in the 3CX environment, then modified the Windows and macOS build environments used to distribute 3CX software.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting from Palo Alto Networks, GitHub, and Cisco Talos shows software supply-chain abuse continuing to intensify, with open-source ecosystems facing rising volumes of vulnerabilities, advisories, and malware. Incident responders said attackers increasingly target developers and build environments because they provide access to source code, CI/CD pipelines, cloud infrastructure, and enterprise endpoints, turning package repositories into an efficient initial-access vector. Cisco Talos detailed how malicious Python packages can execute payloads during installation as well as at runtime by abusing build hooks and package contents, including `setup.py` command classes, `.pth` files, `sitecustomize` and `usercustomize` hooks, `PYTHONPATH` manipulation, import-time code in `__init__.py`, `__main__.py`, and hijacked entry points. The research cited real-world supply-chain cases including TeamPCP activity, the `litellm` compromise, VIPERTUNNEL abuse of site hooks, and the lightning compromise, while defenders were urged to harden package intake with lock files, cryptographic hashes, isolated build environments, SBOM generation, dependency cooldowns, package auditing, and PyPI Trusted Publishing via OIDC.
Jul 14, 2026
Python maintainers and incident responders have highlighted a security risk in `.pth` path configuration files, which can execute arbitrary code during interpreter startup when a line begins with `import` followed by whitespace. A CPython issue raised concern over hidden `.pth` files, while DFIR reporting detailed how the behavior can be abused as a stealthy persistence mechanism that triggers whenever Python starts or imports modules, often from trusted locations such as `site-packages` or user package directories. The technique has been tied to real-world intrusion activity: DFIR analysis cited Volexity’s reporting on exploitation of Palo Alto Networks GlobalProtect `CVE-2024-3400`, where attackers allegedly deployed a backdoor as `/usr/lib/python3.6/site-packages/system.pth` and protected it from deletion. Researchers warned that malicious `.pth` files may evade many default forensic and security workflows because they resemble benign package metadata, though file-creation telemetry and EDR process-chain monitoring can help detect suspicious Python-launched activity.
Aug 1, 2026
Malicious versions `1.82.7` and `1.82.8` of the widely used `litellm` Python package were uploaded to PyPI after attackers used compromised publishing access, turning a popular AI gateway library into a supply-chain malware delivery vehicle. Researchers and project maintainers said the tainted code was absent from the upstream GitHub repository, indicating the compromise occurred in the release pipeline or during package publication. The malware executed on import in `1.82.7`, while `1.82.8` added a `litellm_init.pth` file that triggered on every Python interpreter startup, greatly expanding exposure even beyond direct use of the package. PyPI removed or quarantined the malicious releases, and `1.82.6` was identified as the last known clean version. The payload harvested a broad range of secrets, including cloud credentials, SSH keys, API tokens, Kubernetes service-account tokens, database and CI/CD secrets, `.env` files, shell histories, TLS keys, and cryptocurrency wallet data, then encrypted and exfiltrated the data to attacker-controlled infrastructure including `models.litellm.cloud`. Multiple reports said the malware also attempted Kubernetes lateral movement by enumerating clusters, dumping secrets, and deploying privileged pods across nodes, while establishing Linux persistence through a disguised `systemd` user service that contacted `checkmarx.zone` for follow-on payloads. Researchers linked the intrusion with high confidence to **TeamPCP**, tying it to the earlier Trivy compromise and a broader campaign spanning GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI; organizations that installed and ran the affected versions were urged to assume full credential compromise, rotate secrets, inspect for persistence, and review Kubernetes environments for rogue activity.
Jul 29, 2026