Loading story…
Researchers at InfoGuard identified a new Python-based backdoor, ViperTunnel, inside UK and US business networks, where it appears to provide persistent access that can later be sold or handed off to ransomware operators including RansomHub. The malware was uncovered during incident response to a DragonForce ransomware attack and is frequently seen after FAKEUPDATES (SocGholish) infections. Reporting also says ViperTunnel is often used alongside the ShadowCoil credential stealer, strengthening its role in broader intrusion chains that move from initial compromise to credential theft and eventual ransomware deployment.
ViperTunnel disguises itself as a DLL but is actually a heavily obfuscated Python script that abuses Python's sitecustomize.py auto-loading mechanism for execution and persistence, including via suspicious Windows scheduled tasks. It establishes a SOCKS5 proxy over port 443 to blend malicious traffic with normal web activity, while layered obfuscation and encryption hinder analysis. InfoGuard said the malware has evolved from error-filled early builds into a more modular framework and assessed it is likely linked to UNC2165, a cluster associated with EvilCorp; researchers also found Linux anti-debugging artifacts, including a TracerPid check, indicating the operators may be preparing a future cross-platform version targeting Linux systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Public reporting described ViperTunnel's use of Python's auto-loading sitecustomize.py module, DLL disguise, layered obfuscation, and a SOCKS5 proxy over port 443. InfoGuard also assessed likely ties to UNC2165, a cluster linked to EvilCorp, and noted Linux-focused anti-debugging artifacts suggesting possible future cross-platform targeting.
InfoGuard discovered the Python-based ViperTunnel backdoor while responding to a DragonForce ransomware attack, observing it in UK and US business networks. The malware was used to maintain persistence, often following FAKEUPDATES (SocGholish) infections, and may have been intended for later handoff or sale to ransomware operators.
By late 2025, researchers assessed that ViperTunnel had significantly matured from its earlier builds into a more modular and capable framework used to maintain persistent access in victim environments.
InfoGuard reported that ViperTunnel existed in late 2023 in early forms marked by typo-ridden and less mature code, indicating the malware framework was already in development by that time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **VIPERTUNNEL**, a Python-based backdoor delivered as an obfuscated file masquerading as a DLL and loaded through a malicious `sitecustomize.py`, with persistence established via a scheduled task. After multiple layers of encoding, compression, and decryption are removed, the payload resolves into a SOCKS5 proxy backdoor that connects outbound to a hardcoded command-and-control server over port `443`, authenticates with embedded credentials, and relays traffic into the victim's local network through threaded proxy components. Analysis of samples from late 2023 through late 2025 shows the malware evolving from unstable development builds into a more mature, stealth-focused variant. Investigators linked the infrastructure to **Pyramid C2** servers that frequently expose an HTTP `401` response with a distinctive `Basic realm="Proxy"` header and often use ports `22`, `443`, and sometimes `8000`; the activity has also been associated in reporting with **UNC2165/EvilCorp** and shares obfuscation traits with the **ShadowCoil** credential stealer. Defenders were advised to watch for `pythonw.exe` launched without arguments, suspicious numeric scheduled tasks, unexpected `sitecustomize.py` files, and unusual outbound proxy traffic patterns.
Jul 14, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026