hunt.ioPublished
How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
Excerpt
When Wiz Research published their analysis of the Mini Shai-Hulud supply chain campaign, the focus was on the trojanized npm and PyPI packages used to reach developer machines. What happened after delivery got considerably less coverage. The second-stage payload, a 13-file Python toolkit, is where the actual damage occurs, and no prior vendor report has examined it in full.
This analysis starts where the supply chain reporting stops. The dropper has already landed on the victim machine, and the environment checks have passed. From that point, we traced…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by hunt.io on hunt.io.
Mentioned in the excerpt
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
- Taking Down EmotetTeam Cymru · Published 27 Jan 2021
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
