...Word documents with malicious macros that executed PowerShells scripts to download Pupy.
Pupy
Pupy is an open-source, cross-platform remote access trojan and post-exploitation framework used to control compromised systems and extend operator capabilities through modular functionality.
Profile source: Mallory opens in a new tabPupy
Family profile
Pupy is an open-source, cross-platform remote access trojan and post-exploitation framework used to control compromised systems and extend operator capabilities through modular functionality. It supports Windows and Linux targets and provides operators with host reconnaissance, process discovery, user discovery, network configuration discovery, network share enumeration, credential harvesting, screen capture, keylogging, and data exfiltration over its command-and-control channel. Documented capabilities include listing running processes and parent process identifiers, identifying logged-on users, collecting local host information, enumerating shared drives and folders over SMB, and gathering network configuration details.
Pupy includes modules to execute PowerShell scripts and to harvest credentials through LaZagne integration. It can capture keystrokes, take screenshots including click-triggered mouse-logger captures, and send collected screenshots, keylogger output, files, and recorded audio back to its command-and-control infrastructure. On Windows, it can maintain persistence through startup-folder or Registry Run-key autostart mechanisms. It also supports process migration using reflective DLL injection, enabling execution within other processes for operational flexibility and evasion.
Pupy is widely recognized as a modular RAT/backdoor framework suited for interactive post-compromise operations, surveillance, credential access, and follow-on intrusion activity.
Capabilities
- Credential Theft
- Defense Evasion
- Dll Sideloading
- Exfiltration
- Keylogging
- Persistence
- Post Exploitation
- Process Injection
- Reconnaissance
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
Pupy in ATT&CK
38 distinct techniquesTechniques
38 techniques T1059.001 PowerShell T1113 Screen Capture T1555.003 Credentials from Web Browsers T1057 Process Discovery T1105 Ingress Tool Transfer T1574 Hijack Execution Flow T1071.001 Web Protocols T1056.001 Keylogging T1041 Exfiltration Over C2 Channel T1555 Credentials from Password Stores T1016 System Network Configuration Discovery T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control T1082 System Information Discovery T1033 System Owner/User Discovery T1547 Boot or Logon Autostart Execution T1083 File and Directory Discovery T1055 Process Injection T1620 Reflective Code Loading T1135 Network Share Discovery T1125 Video Capture T1573 Encrypted Channel T1046 Network Service Discovery T1021.001 Remote Desktop Protocol T1112 Modify Registry T1573.002 Asymmetric Cryptography T1087 Account Discovery T1560 Archive Collected Data T1003 OS Credential Dumping T1136.002 Domain Account T1569.002 Service Execution T1204.002 Malicious File T1070.001 Clear Windows Event Logs T1021.002 SMB/Windows Admin Shares T1566.002 Spearphishing Link T1136 Create Account T1552.001 Credentials In Files T1204.003 Malicious Image
Reporting
Research mentioning Pupy
Aug 20
Splunk Research
Detection: Windows Phantom DLL Created on Disk | Splunk Security Content
NightmareEclipse released ShieldBreak, a proof-of-concept local privilege-escalation exploit claimed to bypass Microsoft’s fix for CVE-2026-50656 (RoguePlanet). The exploit allegedly abuses improper link resolution during Windows Defender remediation, combining Cloud Files placeholders, Object Manager symbolic-link swaps, CLFS path handling, an EICAR-triggered scan, and NTFS alternate data streams to redirect a Defender process running as SYSTEM and plant C:\Windows\System32\phoneinfo.dll. A fabricated Windows Error Reporting report and the QueueReporting scheduled task then cause wermgr.exe to load the malicious DLL; the included Warden.dll payload reportedly duplicates a SYSTEM token and opens a SYSTEM shell in the unprivileged user’s session. Splunk published attack data and multiple disabled-by-default analytics for the ShieldBreak chain, covering Defender activity on \globalroot\ object-manager paths (Defender Operational events 1116/1117), MpClient.dll loaded by non-Defender processes, ADS creation through loopback administrative SMB shares (Security event 5145), manually created .wer files in the Windows Error Reporting ReportQueue, creation of phantom DLLs such as phoneinfo.dll in system paths, and WerMgr.exe spawning SYSTEM-integrity children. Organizations should collect the required Sysmon, Security, and Defender Operational telemetry; enable file-share object-access auditing; investigate these signals promptly; and validate the creating process, signer, file hash, and operational need before suppressing alerts.
Aug 19
Splunk Research
Detection: Windows Defender MpClient.dll Loaded by Non-Defender Process | Splunk Security Content
Aug 19
Splunk Research
Detection: Windows Alternate Data Stream Created Over Local Share | Splunk Security Content
Aug 18
Splunk Research
Detection: Windows Defender Threat Detected on Kernel Object Path | Splunk Security Content
Aug 18
Splunk Research
Detection: Windows Error Report Created in ReportQueue Manually | Splunk Security Content
Aug 18
Splunk Research
Detection: Windows Wermgr Spawning System Integrity Process | Splunk Security Content
Aug 17
Splunk Research
Shieldbreak | Splunk Security Content
Aug 13
Threatlocker
