Pupy

Malware type

rat

Family

Malware family

Operating systems

linux, windows, macos, android

Related IoCs

180 (16 malicious)

Last IoC activity

2026-09-02 00:39:45

Profile updated

2026-07-07 15:46:11

Context

Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). Pupy is publicly available on GitHub.

Recent IoC activity

17 malicious indicators in Maltiverse are attributed to Pupy (S0192). The 17 most recently updated:

Detection coverage

• 784 Sigma rules

Malware & tools used

• Screen Capture (attack-pattern)
• Credentials In Files (attack-pattern)
• Ingress Tool Transfer (attack-pattern)
• Network Share Discovery (attack-pattern)
• Asymmetric Cryptography (attack-pattern)
• Bypass User Account Control (attack-pattern)
• PowerShell (attack-pattern)
• System Owner/User Discovery (attack-pattern)
• Domain Account (attack-pattern)
• Exfiltration Over C2 Channel (attack-pattern)
• Credentials from Web Browsers (attack-pattern)
• Audio Capture (attack-pattern)
• Dynamic-link Library Injection (attack-pattern)
• System Network Configuration Discovery (attack-pattern)
• Local Email Collection (attack-pattern)
• Systemd Service (attack-pattern)
• Local Account (attack-pattern)
• XDG Autostart Entries (attack-pattern)
• File and Directory Discovery (attack-pattern)
• System Information Discovery (attack-pattern)
• LSASS Memory (attack-pattern)
• Keylogging (attack-pattern)
• Web Protocols (attack-pattern)
• System Checks (attack-pattern)
• Remote Desktop Protocol (attack-pattern)

Used by threat actors

• Magic Hound (threat-actor)
• APT33 (threat-actor)

Reports & references

• github.com — Pupy (report)
• MITRE ATT&CK — S0192 (report)

External references

• mitre-attack — S0192
• GitHub Pupy
• misp-galaxy
• misp-galaxy