value:  Dragonfly 2.0 used various types of scripting to perform operations including Python scripts. The group was observed installing Python 2.7 on a victim. ;; DropBook is a Python-based backdoor compiled with PyInstaller. ;; Ebury has used Python to implement its DGA. ;; IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector. ;; KeyBoy uses Python scripts for installing files and performing execution. ;; Keydnap uses Python for scripting to execute additional commands. ;; Kimsuky has used a Mac OS Python implant to gather data. ;; Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python. ;; Machete is written in Python and is used in conjunction with additional Python scripts. ;; MechaFlounder uses a python-based payload. ;; MuddyWater has used developed tools in Python including Out1. ;; Operation Wocao's backdoors have been written in Python and compiled with py2exe. ;; PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools. ;; PUNCHBUGGY has used python scripts. ;; Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection adding persistence etc. ;; Pysa has used Python scripts to deploy ransomware. ;; Remcos uses Python scripts. ;; Rocke has used Python-based malware to install and spread their coinminer. ;; SpeakUp uses Python scripts. ;; Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads. ;; ZIRCONIUM has used Python-based implants to interact with compromised hosts.
name: Command and Scripting Interpreter: Python