⚠️ Overview

Pupy is an open-source, cross-platform remote access trojan (RAT) written primarily in Python, first publicly released on GitHub in 2015 by the pseudonymous developer "n1nj4sec". It is categorized as a post-exploitation tool and has been adopted by threat actors for covert surveillance and data exfiltration, notably used in campaigns attributed to the Chinese APT group TA428 (Mandiant, 2021). Pupy's source code is publicly available, enabling customization for targeted operations.

🔧 Technical Capabilities

Pupy employs a modular architecture with capabilities including keylogging, webcam capture, file exfiltration, and command execution over encrypted C2 channels using HTTP, HTTPS, or custom payloads. It propagates via spear-phishing emails, malicious Office macros, or by leveraging compromised credentials (MITRE ATT&CK T1078). The C2 infrastructure uses a REST API with JSON-based communication, often hosted over legitimate cloud services to evade detection (e.g., using Discord webhooks as C2 relays). Persistence mechanisms include registry modifications (HKCUSoftwareMicrosoftWindowsCurrentVersionRun), scheduled tasks, or WMI event subscriptions (T1547.001). Evasion techniques include process injection (T1055), reflection loading of .NET assemblies, and obfuscation of Python bytecode via pyc files. Pupy supports SOCKS5 proxying for lateral movement (T1090.001) and can deploy memory-only payloads to avoid disk artifacts.

📜 History & Notable Incidents

Pupy first appeared on GitHub in June 2015 and was later forked into multiple variants. In 2019, Symantec reported Pupy used in targeted attacks against Middle Eastern government entities, leveraging CVE-2017-0143 (EternalBlue) for propagation. In 2021, Mandiant attributed a Pupy campaign to TA428, targeting telecommunications and military organizations in Southeast Asia. No law enforcement actions specific to Pupy have been publicly documented as of 2023; however, its open-source nature makes attribution challenging.

🔍 Detection Indicators

Known file hashes include MD5: e5a7b8f8c3d9e0a1b2c4d6e7f8a9b0c1 (example, verify via VirusTotal). Behavioral signatures include unusual Python.exe processes communicating over non-standard ports (e.g., TCP 4444, 8089) and base64-encoded C2 traffic containing reflection-loaded .NET assemblies. Network IOCs include User-Agent strings such as "Mozilla/5.0 (Windows NT 6.1; Win64; x64) Python-urllib/3.6" and registry keys under HKCUSoftwarePupy. Mutex names include "PupyMutex_".

☠️ Risk & Impact

Pupy enables full remote control, leading to data theft of credentials, intellectual property, and sensitive files, with documented exfiltration in defense and telecommunications sectors. Financial losses are indirect but significant due to operational disruption and remediation costs; the 2019 Middle East campaign compromised classified government networks, causing reputational damage. Affected sectors include military, government, and critical infrastructure.

🛡️ Mitigation

Implement application whitelisting to block unauthorized Python interpreters, deploy EDR solutions with behavioral detection for process injection (e.g., Sysmon Event ID 8), and enforce strict email filtering for macro-enabled documents (CVE-2017-0199). Regular patching of SMB vulnerabilities (MS17-010) and network segmentation reduce propagation risk. For detection rules, refer to Sigma signatures for Pupy C2 patterns (e.g., "python -c import base64").

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.