Analysis of Pupy RAT Used in Attacks Against Linux Systems

Pupy is a RAT malware strain that offers cross-platform support. Because it is an open-source program published on GitHub, it is continuously being used by various threat actors including APT groups. For example, it is known to have been used by APT35 (said to have ties to Iran) [1] and was also used in Operation Earth Berberoka [2] which targeted online gambling websites. Recently, a malware strain named Decoy Dog was discovered, which is an updated version of Pupy RAT. …

analysis apt apt35 apt groups attacks github iran linux linux systems malware malware analysis platform program pupy pupy rat rat rat malware support systems threat threat actors