papers.lisdex.sh · PDF
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
Excerpt
Carter Perez
© A N G E L A M O S / S EC U R I T Y R E S E A R C H
VIVISECTION
of Hermes
An Active Russian-Market Malware-as-a-Service Platform
and Its PyMapper Distribution Chain
github.com/CarterPerez-dev
R E S E A RC H PA P E R
2026-10-24
© AngelaMos 2026 1
A Python repository advertised as an asynchronous scraper concealed a Windows malware loader in its import path. Following that loader led to Hermes, a subscription service combining credential collection, file access and interactive control of visible and hidden desktops. The investigation recovered two delivery routes, an integrated native client, fifteen versioned module binaries and the operator-facing application that organizes those capabilities.
This investigation reconstructs the machinery behind Hermes: how…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by papers.lisdex.sh on papers.lisdex.sh.
More from papers.lisdex.sh1
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
Hermes is a commercial Windows malware platform that combines credential theft with interactive remote access. Advertisements on Russian-language cybercrime forums offer tiered subscriptions. The service has an operator web panel, worker accounts and a…
On the same topics
K7 Labs · Web page · Published 21 Mar
Volume II: Who aM I? Confessions of an Obfuscated JS Worm
This is volume II of a three part series based on our (Kaarthik RM and Rajababu A) paper for AVAR 2013, discussing the prevalence of autorun malware in the Asian region, taking it further by analyzing an example of such a malware Carrying on from where we…
Elastic Security Labs · Web page · Published 26 Mar
The Shelby Strategy
The SHELBY malware family abuses GitHub for command-and-control, stealing data and retrieving commands The attacker’s C2 design has a critical flaw: anyone with the PAT token can control infected machines, exposing a significant security vulnerability Unused…
Kaspersky · Web page · Published 21 Oct
Operation FlashHole: Lazarus breaks security, defies control
In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we…
K7 Labs · Web page · Published 14 Mar
Volume I: Who aM I? Confessions of an Obfuscated JS Worm
This is volume I of a three part series based on our (Kaarthik RM and Rajababu A) paper for AVAR 2013, discussing the prevalence of autorun malware in the Asian region, taking it further by analyzing an example of such a malware To Brief it Out… The Autorun…