Loading story…
Researchers detailed VIPERTUNNEL, a Python-based backdoor delivered as an obfuscated file masquerading as a DLL and loaded through a malicious sitecustomize.py, with persistence established via a scheduled task. After multiple layers of encoding, compression, and decryption are removed, the payload resolves into a SOCKS5 proxy backdoor that connects outbound to a hardcoded command-and-control server over port 443, authenticates with embedded credentials, and relays traffic into the victim's local network through threaded proxy components.
Analysis of samples from late 2023 through late 2025 shows the malware evolving from unstable development builds into a more mature, stealth-focused variant. Investigators linked the infrastructure to Pyramid C2 servers that frequently expose an HTTP 401 response with a distinctive Basic realm="Proxy" header and often use ports 22, 443, and sometimes 8000; the activity has also been associated in reporting with UNC2165/EvilCorp and shares obfuscation traits with the ShadowCoil credential stealer. Defenders were advised to watch for pythonw.exe launched without arguments, suspicious numeric scheduled tasks, unexpected sitecustomize.py files, and unusual outbound proxy traffic patterns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The SOC Prime write-up states that the VIPERTUNNEL campaign is linked to UNC2165 and EvilCorp, and notes shared obfuscation techniques with the ShadowCoil credential stealer.
Infrastructure hunting tied the malware to Pyramid C2 instances with a consistent footprint, including HTTP 401 responses with a distinctive Basic realm="Proxy" header, and found evidence that the infrastructure remained active into late 2025.
Across samples spanning through late 2025, VIPERTUNNEL progressed into a more mature Python-based SOCKS5 backdoor/proxy with layered obfuscation, decryption, and outbound tunneling to hardcoded C2 infrastructure over port 443.
InfoGuard Labs reported that observed VIPERTUNNEL samples cluster into developmental variants beginning in late 2023, starting with error-prone and less-obfuscated builds before later maturation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at InfoGuard identified a new Python-based backdoor, **ViperTunnel**, inside UK and US business networks, where it appears to provide persistent access that can later be sold or handed off to ransomware operators including **RansomHub**. The malware was uncovered during incident response to a **DragonForce** ransomware attack and is frequently seen after **FAKEUPDATES** (`SocGholish`) infections. Reporting also says ViperTunnel is often used alongside the **ShadowCoil** credential stealer, strengthening its role in broader intrusion chains that move from initial compromise to credential theft and eventual ransomware deployment. ViperTunnel disguises itself as a DLL but is actually a heavily obfuscated Python script that abuses Python's `sitecustomize.py` auto-loading mechanism for execution and persistence, including via suspicious Windows scheduled tasks. It establishes a **SOCKS5** proxy over port `443` to blend malicious traffic with normal web activity, while layered obfuscation and encryption hinder analysis. InfoGuard said the malware has evolved from error-filled early builds into a more modular framework and assessed it is likely linked to **UNC2165**, a cluster associated with **EvilCorp**; researchers also found Linux anti-debugging artifacts, including a `TracerPid` check, indicating the operators may be preparing a future cross-platform version targeting Linux systems.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Threat researchers reported a new **Python-based Windows information-stealing malware** dubbed **SolyxImmortal** that emphasizes *stealth and long-term persistence* over destructive actions. The implant is described as a “monolithic” package (not modular), delivered as a legitimate-looking Python script (e.g., `Lethalcompany.py`), and runs quietly in the background to harvest sensitive data including credentials, documents, keystrokes, and screenshots. SolyxImmortal’s command-and-control and exfiltration model relies on **Discord webhooks**, abusing trusted HTTPS traffic to blend in and reduce network-based detection. Reporting attributes the analysis to **CYFIRMA**, noting that C2 parameters are hardcoded and that operators can receive real-time notifications (including via a hardcoded Discord user ID) for high-value events; separate webhooks may be used for different data types (e.g., logs/files vs. screenshots). The malware targets browser-stored data (including Chromium-based browsers such as Chrome, Edge, Brave, and Opera GX) and focuses on single-host surveillance rather than lateral movement.
Jun 29, 2026