Command and Scripting Interpreter: Python

APT29 has developed malware variants written in Python.^[2]

APT37 has used Python scripts to execute payloads.^[3]

APT39 has used a command line utility and a network scanner written in python.^[4][5]

Bandook can support commands to execute Python-based payloads.^[6]

BRONZE BUTLER has made use of Python-based remote access tools.^[7]

Bundlore has used Python scripts to execute payloads.^[8]

Chaes has used Python scripts for execution and the installation of additional files.^[9]

Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.^[10]

Cobalt Strike can use Python to perform execution.^{[11][12][13][14]}

CoinTicker executes a Python script to download its second stage.^[15]

Contagious Interview has used the Python-based malware such as InvisibleFerret to install and execute Python Packages and Python modules.^[16][17][18]

CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.^[19]

During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.^[20][21]

Donut can generate shellcode outputs that execute via Python.^[22]

Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.^[23]

DropBook is a Python-based backdoor compiled with PyInstaller.^[24]

Earth Lusca used Python scripts for port scanning or building reverse shells.^[25]

Ebury has used Python to implement its DGA.^[26]

FRAMESTING is a Python web shell that can embed in the Ivanti Connect Secure CAV Python package.^[27]

InvisibleFerret is written in Python and has used Python scripts for execution.^{[16][28][17][29][18]}

IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.^[30]

KeyBoy uses Python scripts for installing files and performing execution.^[31]

Keydnap uses Python for scripting to execute additional commands.^[32]

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.^[33][34]

Lizar has used Python scripts (ps2x.py script and ps2p.py) to execute files on remote hosts using the Impacket library.^[35]

Lumma Stealer has used malicious Python scripts to execute payloads.^[36]

Machete is written in Python and is used in conjunction with additional Python scripts.^[37][38][39]

Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.^[40][37][39]

MechaFlounder uses a python-based payload.^[41]

MuddyWater has developed tools in Python including Out1.^[42]

Neo-reGeorg is a Python-based web shell.^[43]

During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.^[44]

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.^[45]

PUNCHBUGGY has used python scripts.^[46]

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.^[47]

PyDCrypt, along with its functions, is written in Python.^[48]

Pysa has used Python scripts to deploy ransomware.^[49]

RedCurl has used a Python script to establish outbound communication and to execute commands using SMB port 445.^[50]

reGeorg is a Python-based web shell.^[51]

Remcos uses Python scripts.^[52]

Rocke has used Python-based malware to install and spread their coinminer.^[53]

During Salesforce Data Exfiltration, threat actors used custom applications developed in python.^[54]

During ShadowRay, threat actors used the Python pty module to open reverse shells.^[55]

SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.^[56][57]

Small Sieve can use Python scripts to execute commands.^[58]

SpeakUp uses Python scripts.^[59]

THINCRUST can use Python scripts for command execution.^[60]

Tonto Team has used Python-based tools for execution.^[61]

Turian has the ability to use Python to spawn a Unix shell.^[62]

Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.^[30]

UNC3886 has used Python scripts to enumerate ESXi hosts and guest VMs.^[63]

UPSTYLE is a Python-based application.^[64][65]

VIRTUALPIE is a Python-based backdoor malware.^[66][67]

VIRTUALPITA can call a Python script to run commands on a targeted guest virtual machine.^[66]

ZIRCONIUM has used Python-based implants to interact with compromised hosts.^[68][1]

Anti-virus can be used to automatically quarantine suspicious files.

Inventory systems for unauthorized Python installations.

Denylist Python where not required.

Prevent users from installing Python where not required.