H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Peppy

[Peppy](https://attack.mitre.org/software/S0643) is a Python-based remote access Trojan, active since at least 2012, with similarities to [Crimson](https://attack.mitre.org/software/S0115).(Citation: Proofpoint Operation Transparent Tribe March 2016)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Peppy](https://attack.mitre.org/software/S0643) is a Python-based remote access Trojan, active since at least 2012, with similarities to [Crimson](https://attack.mitre.org/software/S0115).(Citation: Proofpoint Operation Transparent Tribe March 2016)

Labels

malware
8 recorded

Relationships

uses
to Automated Exfiltration
Technique
uses
to File and Directory Discovery
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Keylogging
Technique
uses
to Screen Capture
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
from Transparent Tribe
Group
2 external

References

mitre-attack
S0643
open
Proofpoint Operation Transparent Tribe March 2016
https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance