Command and Scripting Interpreter: Python

APT29 has developed malware variants written in Python.^[1]

APT37 has used Python scripts to execute payloads.^[2]

APT39 has used a command line utility and a network scanner written in python.^[3][4]

Bandook can support commands to execute Python-based payloads.^[5]

BRONZE BUTLER has made use of Python-based remote access tools.^[6]

Bundlore has used Python scripts to execute payloads.^[7]

Chaes has used Python scripts for execution and the installation of additional files.^[8]

Cobalt Strike can use Python to perform execution.^{[9][10][11][12]}

CoinTicker executes a Python script to download its second stage.^[13]

CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.^[14]

Dragonfly 2.0 used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.^[15][16]

DropBook is a Python-based backdoor compiled with PyInstaller.^[17]

Ebury has used Python to implement its DGA.^[18]

IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.^[19]

KeyBoy uses Python scripts for installing files and performing execution.^[20]

Keydnap uses Python for scripting to execute additional commands.^[21]

Kimsuky has used a Mac OS Python implant to gather data.^[22]

Machete is written in Python and is used in conjunction with additional Python scripts.^[23][24][25]

Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.^[26][23][25]

MechaFlounder uses a python-based payload.^[27]

MuddyWater has used developed tools in Python including Out1.^[28]

Operation Wocao's backdoors have been written in Python and compiled with py2exe.^[29]

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.^[30]

PUNCHBUGGY has used python scripts.^[31]

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.^[32]

Pysa has used Python scripts to deploy ransomware.^[33]

Remcos uses Python scripts.^[34]

Rocke has used Python-based malware to install and spread their coinminer.^[35]

SpeakUp uses Python scripts.^[36]

Tonto Team has used Python-based tools for execution.^[37]

TRITON was run as trilog.exe, a Py2EXE compiled python script that accepts a single IP address as a flag.^[38]

Turian has the ability to use Python to spawn a Unix shell.^[39]

Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.^[19]

ZIRCONIUM has used Python-based implants to interact with compromised hosts.^[40][41]

Anti-virus can be used to automatically quarantine suspicious files.

Inventory systems for unauthorized Python installations.

Denylist Python where not required.

Prevent users from installing Python where not required.