Pupy

Pupy is a cross-platform, multi-function Remote Access Trojan (RAT) and post-exploitation tool primarily developed in Python. It has the capability to operate on several platforms including Windows, Linux, and mobile devices, although its support for Android and OSX is limited and it has not been thoroughly tested on Windows. The software communicates using multiple transports, can migrate into processes using reflective injection, and can load remote python code, python packages, and python C-extensions from memory. These features allow Pupy to remain undetected in networks for extended periods, making it a potent tool in cyber attacks. The tool has been observed in numerous nation state attacks and serious network compromises, targeting mainly enterprise environments. It is particularly known for deploying a remote access trojan called Pupy RAT, which is proficient at hiding within networks. From the Pupy shell, users can interactively access remote objects and get auto-completion of remote attributes. This functionality makes it an effective tool for attackers seeking to maintain control over compromised systems. Investigations into the use of Pupy and Pupy RAT, especially in relation to the Decoy Dog toolkit, are ongoing. The signature of the Decoy Dog toolkit is unique enough that its presence often indicates not just the deployment of the open-source Pupy RAT but also the use of the Decoy Dog toolkit itself. While the frequency of these network compromises is still relatively rare, the potential damage they could cause underscores the need for continued vigilance and investigation.