Command and Scripting Interpreter: Python

APT29 has developed malware variants written in Python.^[1]

APT37 has used Python scripts to execute payloads.^[2]

APT39 has used a command line utility and a network scanner written in python.^[3][4]

Bandook can support commands to execute Python-based payloads.^[5]

BRONZE BUTLER has made use of Python-based remote access tools.^[6]

Bundlore has used Python scripts to execute payloads.^[7]

Chaes has used Python scripts for execution and the installation of additional files.^[8]

Cobalt Strike can use Python to perform execution.^{[9][10][11][12]}

CoinTicker executes a Python script to download its second stage.^[13]

CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.^[14]

Donut can generate shellcode outputs that execute via Python.^[15]

Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.^[16]

DropBook is a Python-based backdoor compiled with PyInstaller.^[17]

Ebury has used Python to implement its DGA.^[18]

IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.^[19]

KeyBoy uses Python scripts for installing files and performing execution.^[20]

Keydnap uses Python for scripting to execute additional commands.^[21]

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.^[22][23]

Machete is written in Python and is used in conjunction with additional Python scripts.^[24][25][26]

Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.^[27][24][26]

MechaFlounder uses a python-based payload.^[28]

MuddyWater has used developed tools in Python including Out1.^[29]

Operation Wocao's backdoors have been written in Python and compiled with py2exe.^[30]

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.^[31]

PUNCHBUGGY has used python scripts.^[32]

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.^[33]

Pysa has used Python scripts to deploy ransomware.^[34]

Remcos uses Python scripts.^[35]

Rocke has used Python-based malware to install and spread their coinminer.^[36]

SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.^[37][38]

SpeakUp uses Python scripts.^[39]

Tonto Team has used Python-based tools for execution.^[40]

TRITON was run as trilog.exe, a Py2EXE compiled python script that accepts a single IP address as a flag.^[41]

Turian has the ability to use Python to spawn a Unix shell.^[42]

Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.^[19]

ZIRCONIUM has used Python-based implants to interact with compromised hosts.^[43][44]

Anti-virus can be used to automatically quarantine suspicious files.

Inventory systems for unauthorized Python installations.

Denylist Python where not required.

Prevent users from installing Python where not required.