Threat intelligence / Technique

Python

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

68 recorded

Relationships

mitigates

from Antivirus/Antimalware

Mitigation

mitigates

from Audit

Mitigation

mitigates

from Execution Prevention

Mitigation

mitigates

from Limit Software Installation

Mitigation

subtechnique-of

to Command and Scripting Interpreter

Technique

uses

from APT29

Group

uses

from APT37

Group

uses

from APT39

Group

uses

Malware

uses

from BRONZE BUTLER

Group

uses

Malware

uses

from CanisterWorm

Malware

uses

from Chaes

Malware

uses

from Cinnamon Tempest

Group

uses

from Cobalt Strike

Malware

uses

from CoinTicker

Malware

uses

from Contagious Interview

Group

uses

from CookieMiner

Malware

uses

from Cutting Edge

Campaign

uses

from Donut

Tool

uses

Group

uses

Malware

uses

Malware

uses

from Earth Lusca

Group

uses

from Ebury

Malware

uses

from FRAMESTING

Malware

uses

from InvisibleFerret

Malware

uses

from IronNetInjector

Tool

uses

Malware

uses

Malware

uses

Group

uses

Malware

uses

from Lizar

Malware

uses

from Lumma Stealer

Malware

uses

Malware

uses

Group

uses

from MechaFlounder

Malware

uses

from Mini Shai-Hulud

Malware

uses

from MuddyWater

Group

uses

from Neo-reGeorg

Malware

uses

from Operation Wocao

Campaign

uses

Malware

uses

from PUNCHBUGGY

Malware

uses

from Pupy

Tool

uses

Malware

uses

from Pysa

Malware

uses

Group

uses

Malware

uses

Tool

uses

from Rocke

Group

uses

from Salesforce Data Exfiltration

Campaign

uses

Campaign

uses

from SILENTTRINITY

Tool

uses

from Small Sieve

Malware

uses

from SPAWNCHIMERA

Malware

uses

Malware

uses

Group

uses

from TeamPCP Cloud Stealer

Malware

uses

Malware

uses

from Tonto Team

Group

uses

Malware

uses

from Turla

Group

uses

Group

uses

Malware

uses

from VIRTUALPIE

Malware

uses

from VIRTUALPITA

Malware

uses

from VOID MANTICORE

Group

uses

Group

2 external

References

mitre-attack

T1059.006

Zscaler APT31 Covid-19 October 2020

https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online