Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.1 Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
- Zscaler APT31 Covid-19 October 2020
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0095 | Machete | — |
| grp_g0128 | ZIRCONIUM | — |
| grp_g1056 | TeamPCP | — |
| grp_g1045 | Salt Typhoon | — |
| grp_g1021 | Cinnamon Tempest | China |
| grp_g1048 | UNC3886 | — |
| grp_g0035 | Dragonfly | Russia |
| grp_g1039 | RedCurl | Russia |
| grp_g0131 | Tonto Team | China |
| grp_g1052 | Contagious Interview | — |
| grp_g0069 | MuddyWater | — |
| grp_g1055 | VOID MANTICORE | — |
| grp_g0067 | APT37 | DPRK |
| grp_g0082 | APT38 | DPRK |
| grp_g0087 | APT39 | — |
| grp_g0010 | Turla | Russia |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0060 | BRONZE BUTLER | — |
| grp_g0106 | Rocke | — |
| grp_g1006 | Earth Lusca | China |
| grp_g0016 | APT29 | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.