...Word documents with malicious macros that executed PowerShells scripts to download Pupy.
Malware family
Pupy
Pupy is an open-source, cross-platform remote access trojan (RAT) and post-exploitation framework written mainly in Python.
Profile source: Mallory opens in a new tabPupy
Family profile
Pupy is an open-source, cross-platform remote access trojan (RAT) and post-exploitation framework written mainly in Python. The provided content describes capabilities on both Windows and Linux, including local information enumeration on Linux hosts and discovery of currently logged-on users on Windows. Pupy supports encrypted command-and-control communications, using SSL by default with additional RSA and AES transport options noted. One cited 2023 Decoy Dog activity cluster, reported by Infoblox, involved Pupy RAT operating over DNS command and control using TXT records.
The malware includes broad surveillance and collection functionality. It can access a connected webcam and capture pictures, record microphone audio, capture screenshots, and send screenshots, files, keylogger data, and recorded audio back to its C2 server. Credential access is a prominent capability in the content: Pupy can use LaZagne repeatedly for credential harvesting, including credentials from browsers, mail, WiFi, and other local sources as described for LaZagne generally, and it can execute both LaZagne and Mimikatz via PowerShell.
Pupy also supports execution and post-exploitation modules. The content states it has a module for loading and executing PowerShell scripts, can use PowerView to execute net user commands and create local system accounts, has a built-in port scanning module, and can enable or disable RDP connections as well as start a remote desktop session through a browser WebSocket client. A cited PowerShell session associated with Pupy showed deletion of Registry keys under HKCU:\Software\Classes\Folder* using Remove-Item -Recurse -Force, characterized in the source as cleanup of privilege-escalation artifacts. Overall, the content portrays Pupy as a multifunctional post-compromise framework supporting reconnaissance, credential theft, surveillance, remote administration, and exfiltration over its established C2 channel.
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
Pupy in ATT&CK
32 distinct techniquesTechniques
32 techniques T1547.001 Registry Run Keys / Startup Folder T1082 System Information Discovery T1083 File and Directory Discovery T1125 Video Capture T1071.001 Web Protocols T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1573 Encrypted Channel T1057 Process Discovery T1041 Exfiltration Over C2 Channel T1059.001 PowerShell T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers T1547 Boot or Logon Autostart Execution T1046 Network Service Discovery T1021.001 Remote Desktop Protocol T1112 Modify Registry T1573.002 Asymmetric Cryptography T1087 Account Discovery T1113 Screen Capture T1560 Archive Collected Data T1003 OS Credential Dumping T1136.002 Domain Account T1548.002 Bypass User Account Control T1569.002 Service Execution T1204.002 Malicious File T1070.001 Clear Windows Event Logs T1021.002 SMB/Windows Admin Shares T1566.002 Spearphishing Link T1136 Create Account T1552.001 Credentials In Files T1204.003 Malicious Image
Reporting
Research mentioning Pupy
Jun 6
Codeby
Скрытые C2 каналы: DNS tunneling и HTTP от атаки до детекта
В кампании Decoy Dog (2023, по данным Infoblox) - кластер активности с Pupy RAT поверх DNS C2 через TXT-записи. Pupy - это кроссплатформенный RAT и фреймворк для постэксплуатации с открытым исходным кодом, написанный преимущественно на языке Python.
Jan 30
Red Canary
Trapping the Netwire RAT on Linux | Red Canary
"...cross-platform RATs that work across multiple operating systems, such as CrossRAT, Pupy, and Netwire."
Nov 19
Mitre Attack Website
Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®
Pupy has a module for loading and executing PowerShell scripts.
Nov 19
Mitre Attack Website
Credentials from Password Stores, Technique T1555 - Enterprise | MITRE ATT&CK®
Pupy can use Lazagne for harvesting credentials.
Nov 19
Mitre Attack Website
Credentials from Password Stores, Technique T1555 - Enterprise | MITRE ATT&CK®
Pupy can use Lazagne for harvesting credentials.
Mar 7
Mitre Attack Website
Remote Services: Remote Desktop Protocol, Sub-technique T1021.001 - Enterprise | MITRE ATT&CK®
Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.
Mar 7
Mitre Attack Website
Audio Capture, Technique T1123 - Enterprise | MITRE ATT&CK®
Pupy can record sound with the microphone.
Mar 7
Mitre Attack Website
Unsecured Credentials: Credentials In Files, Sub-technique T1552.001 - Enterprise | MITRE ATT&CK®
Pupy can use Lazagne for harvesting credentials.
