Command and Scripting Interpreter: Python

APT29 has developed malware variants written in Python.^[2]

APT37 has used Python scripts to execute payloads.^[3]

APT39 has used a command line utility and a network scanner written in python.^[4][5]

Bandook can support commands to execute Python-based payloads.^[6]

BRONZE BUTLER has made use of Python-based remote access tools.^[7]

Bundlore has used Python scripts to execute payloads.^[8]

Chaes has used Python scripts for execution and the installation of additional files.^[9]

Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.^[10]

Cobalt Strike can use Python to perform execution.^{[11][12][13][14]}

CoinTicker executes a Python script to download its second stage.^[15]

CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.^[16]

During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.^[17][18]

Donut can generate shellcode outputs that execute via Python.^[19]

Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.^[20]

DropBook is a Python-based backdoor compiled with PyInstaller.^[21]

Earth Lusca used Python scripts for port scanning or building reverse shells.^[22]

Ebury has used Python to implement its DGA.^[23]

FRAMESTING is a Python web shell that can embed in the Ivanti Connect Secure CAV Python package.^[24]

IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.^[25]

KeyBoy uses Python scripts for installing files and performing execution.^[26]

Keydnap uses Python for scripting to execute additional commands.^[27]

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.^[28][29]

Machete is written in Python and is used in conjunction with additional Python scripts.^[30][31][32]

Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.^[33][30][32]

MechaFlounder uses a python-based payload.^[34]

MuddyWater has developed tools in Python including Out1.^[35]

During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.^[36]

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.^[37]

PUNCHBUGGY has used python scripts.^[38]

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.^[39]

PyDCrypt, along with its functions, is written in Python.^[40]

Pysa has used Python scripts to deploy ransomware.^[41]

RedCurl has used a Python script to establish outbound communication and to execute commands using SMB port 445.^[42]

Remcos uses Python scripts.^[43]

Rocke has used Python-based malware to install and spread their coinminer.^[44]

SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.^[45][46]

Small Sieve can use Python scripts to execute commands.^[47]

SpeakUp uses Python scripts.^[48]

Tonto Team has used Python-based tools for execution.^[49]

Turian has the ability to use Python to spawn a Unix shell.^[50]

Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.^[25]

ZIRCONIUM has used Python-based implants to interact with compromised hosts.^[51][1]

Anti-virus can be used to automatically quarantine suspicious files.

Inventory systems for unauthorized Python installations.

Denylist Python where not required.

Prevent users from installing Python where not required.