{“lastseen”:”2026-05-06T14:05:12″,”description”:”\\n\\n## Introduction\\n\\nThrough our daily threat hunting, we noticed that, beginning in July 2025, a series of malicious wheel packages were uploaded to PyPI (the Python Package Index). We shared this information with the public security community, and the malware was removed from the repository. We submitted the samples to Kaspersky Threat Attribution Engine (KTAE) for analysis. Based on the results, we believe the packages may be linked to malware discussed in a Threat Intelligence report on OceanLotus. \\n\\nWhile these wheel packages do implement the features described on their PyPI web pages, their true purpose is to covertly deliver malicious files. These files can be either .DLL or .SO (Linux shared library), indicating the packages’ ability to target both Windows and Linux platforms. They function as droppers, delivering the final payload \u2013 a previously unknown malware family that we have named `ZiChatBot`. Unlike traditional malware, ZiChatBot does not communicate with a dedicated command and control (C2) server, but instead uses a series of REST APIs from the public team chat app Zulip as its C2 infrastructure.\\n\\nTo conceal the malicious package containing ZiChatBot, the attacker created another benign-looking package that included the malicious package as a dependency. Based on these facts, we confirm that this campaign is a carefully planned and executed PyPI supply chain attack.\\n\\n## Technical details\\n\\n### Spreading\\n\\nThe attacker created three projects on PyPI and uploaded malicious wheel packages designed to imitate popular libraries, tricking users into downloading them. This is a clear example of a supply chain attack via PyPI. See below for detailed information about the fake libraries and their corresponding wheel packages.\\n\\n#### Malicious wheel packages\\n\\nThe packages added by the attacker and listed on PyPI’s download pages are:\\n\\n * `uuid32-utils` library for generating a 32-character random string as a UUID\\n * `colorinal` library for implementing cross-platform color terminal text\\n * `termncolor` library for ANSI color format for terminal output\\n\\n\\n\\nThe key metadata for these packages are as follows:\\n\\n**Pip install command** | **File name** | **First upload date** | **Author \/ Email** \\n—|—|—|— \\npip install uuid32-utils | uuid32_utils-1.x.x-py3-none-[OS platform].whl | 2025-07-16 | laz**** \/ laz****@tutamail.com \\npip install colorinal | colorinal-0.1.7-py3-none-[OS platform].whl | 2025-07-22 | sym**** \/ sym****@proton.me \\npip install termncolor | termncolor-3.1.0-py3-none-any.whl | 2025-07-22 | sym**** \/ sym****@proton.me \\n \\nBased on the distribution information on the PyPI web page, we can see that it offers X86 and X64 versions for Windows, as well as an x86_64 version for Linux. The `colorinal` project, for example, provides the following download options:\\n\\n\\n\\nDistribution information of the colorinal project\\n\\n#### Initial infection\\n\\nThe `uuid32-utils` and `colorinal` libraries employ similar infection chains and malicious payloads. As a result, this analysis will focus on the `colorinal` library as a representative example.\\n\\nA quick look at the code of the third library, `termncolor`, reveals no apparent malicious content. However, it imports the malicious `colorinal` library as a dependency. This method allows attackers to deeply conceal malware, making the `termncolor` library appear harmless when distributing it or luring targets.\\n\\n\\n\\nThe termncolor library imports the malicious colorinal library\\n\\nDuring the initial infection stage, the Python code is nearly identical across both Windows and Linux platforms. Here, we analyze the Windows version as an example.\\n\\n#### Windows version\\n\\nOnce a Python user downloads and installs the `colorinal-0.1.7-py3-none-win_amd64.whl` wheel package file, or installs it using the `pip` tool, the ZiChatBot’s dropper (a file named `terminate.dll`) will be extracted from the wheel package and placed on the victim’s hard drive.\\n\\nAfter that, if the `colorinal` library is imported into the victim’s project, the Python script file at [Python library installation path]\\\\colorinal-0.1.7-py3-none-win_amd64\\\\colorinal\\\\\\\\__init__.py will be executed first.\\n\\n\\n\\nThe __init__.py script imports the malicious file unicode.py\\n\\nThis Python script imports and executes another script located at [python library install path]\\\\colorinal-0.1.7-py3-none-win_amd64\\\\colorinal\\\\unicode.py. The `is_color_supported()` function in `unicode.py` is called immediately.\\n\\n\\n\\nThe code loads the dropper into the host Python process\\n\\nThe comment in the `is_color_supported()` function states that the highlighted code checks whether the user’s terminal environment supports color. The code actually loads the `terminate.dll` file into the Python process and then invokes the DLL’s exported function `envir`, passing the UTF-8-encoded string `xterminalunicod` as a parameter. The DLL acts as a dropper, delivering the final payload, `ZiChatBot`, and then self-deleting. At the end of the `is_color_supported()` function, the `unicode.py` script file is also removed. These steps eliminate all malicious files in the library and deploy `ZiChatBot`. \\nFor the Linux platform, the wheel package and the `unicode.py` Python script are nearly identical to the Windows version. The only difference is that the dropper file is named \\”terminate.so\\”.\\n\\n### Dropper for ZiChatBot\\n\\nFrom the previous analysis, we learned that the dropper is loaded into the host Python process by a Python script and then activated. The main logic of the dropper is implemented in the `envir` export function to achieve three objectives:\\n\\n 1. Deploy `ZiChatBot`.\\n 2. Establish an auto-run mechanism.\\n 3. Execute shellcode to remove the dropper file (terminate.dll) and the malicious script file from the installed library folder.\\n\\n\\n\\nThe dropper first decrypts sensitive strings using AES in CBC mode. The key is the string-type parameter \\”xterminalunicode\\” of the exported function. The decrypted strings are \\”libcef.dll\\”, \\”vcpacket\\”, \\”pkt-update\\”, and \\”vcpktsvr.exe\\”.\\n\\nNext, the malware uses the same algorithm to decrypt the embedded data related to `ZiChatBot`. It then decompresses the decrypted data with LZMA to retrieve the files `vcpktsvr.exe` and `libcef.dll` associated with `ZiChatBot`. The malware creates a folder named vcpacket in the system directory `%LOCALAPPDATA%`, and places these files into it.\\n\\nTo establish persistence for ZiChatBot, the dropper creates the following auto-run entry in the registry:\\n \\n \\n [HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run]\\n \\”pkt-update\\”=\\”C:\\\\Users\\\\[User name]\\\\AppData\\\\Local\\\\vcpacket\\\\vcpktsvr.exe\\”\\n\\nOnce preparations are complete, the malware uses the XOR algorithm to decrypt the embedded shellcode with the three-byte key `3a7`. It then searches the decrypted shellcode’s memory for the string `Policy.dllcppage.dll` and replaces it with its own file name, `terminate.dll`, and redirects execution to the shellcode’s memory space.\\n\\nThe shellcode employs a djb2-like hash method to calculate the names of certain APIs and locate their addresses. Using these APIs, it finds the dropper file with the name `terminate.dll` that was previously passed by the DLL before unloading and deleting it.\\n\\n#### Linux version\\n\\nThe Linux version of the dropper places `ZiChatBot` in the path `\/tmp\/obsHub\/obs-check-update` and then creates an auto-run job using `crontab`. Unlike the Windows version, the Linux version of `ZiChatBot` only consists of one ELF executable file.\\n \\n \\n system(\\”chmod +x \/tmp\/obsHub\/obs-check-update\\”) \\n system(\\”echo \\\\\\”5 * * * * \/tmp\/obsHub\/obs-check-update\\” | crontab – \\”)\\n\\n### ZiChatBot\\n\\nThe Windows version of ZiChatBot is a DLL file (`libcef.dll`) that is loaded by the legitimate executable `vcpktsvr.exe` (hash: 48be833b0b0ca1ad3cf99c66dc89c3f4). The DLL contains several export functions, with the malicious code implemented in the `cef_api_mash export`. Once the DLL is loaded, this function is invoked by the EXE file. ZiChatBot uses the REST APIs from Zulip, a public team chat application, as its command and control server.\\n\\nZiChatBot is capable of executing shellcode received from the server and only supports this one control command. Once it runs, it initiates a series of sequential HTTP requests to the Zulip REST API.\\n\\nIn each HTTP request, an API authentication token is included as an HTTP header for server-side authentication, as shown below.\\n \\n \\n \/\/ Auth token:\\n TW9yaWFuLWJvdEBoZWxwZXIuenVsaXBjaGF0LmNvbTpVOFJFWGxJNktmOHFYQjlyUXpPUEJpSUE0YnJKNThxRw==\\n \\n \/\/ Decoded Auth token\\n Morian-bot@helper.zulipchat.com:U8REXlI6Kf8qXB9rQzOPBiIA4brJ58qG\\n\\nZiChatBot utilizes two separate channel-topic pairs for its operations. One pair transmits current system information, and the other retrieves a message containing shellcode. Once the shellcode is received, a new thread is created to execute it. After executing the command, a `heart` emoji is sent in response to the original message to indicate the execution was successful.\\n\\n## Infrastructure\\n\\nWe did not find any traditional infrastructure, such as compromised servers or commercial VPS services and their associated IPs and domains. Instead, the malicious wheel packages were uploaded to the Python Package Index (PyPI), a public, shared Python library. The malware, ZiChatBot, leverages Zulip’s public team chat REST APIs as its command and control server.\\n\\nThe \\”helper\\” organization that the attacker had registered on the Zulip service has now been officially deactivated by Zulip. However, infected devices may still attempt to connect to the service, so to help you locate and cure them, we recommend adding the full URL `helper.zulipchat.com` to your denylist.\\n\\n## Victims\\n\\nThe malware was uploaded in July 2025. Upon discovering these attacks, we quickly released an update for our product to detect the relevant files and shared the necessary information with the public security community. As a result, the malicious software was swiftly removed from PyPI, and the organization registered on the Zulip service was officially deactivated. To date, we have not observed any infections based on our telemetry or public reports.\\n\\n\\n\\nZulip has officially deactivated the \\”helper\\” organization\\n\\n## Attribution\\n\\nBased on the results from our KTAE system, the dropper used by ZiChatBot shows a 64% similarity to another dropper we analyzed in a TI report, which was linked to OceanLotus. Reverse engineering shows that both droppers use nearly identical algorithms and logic for to decrypt and decompress their embedded payloads.\\n\\n\\n\\nAnalysis results of dropper using KTAE system\\n\\n## Conclusions\\n\\nAs an active APT organization, OceanLotus primarily targets victims in the Asia-Pacific region. However, our previous reports have highlighted a growing trend of the group expanding its activities into the Middle East. Moreover, the attacks described in this report \u2013 executed through PyPI \u2013 target Python users worldwide. This demonstrates OceanLotus’s ongoing effort to broaden its attack scope.\\n\\nIn the first half of 2025, a public report revealed that the group launched a phishing campaign using GitHub. The recent PyPI-based supply chain attack likely continues this strategy. Although phishing emails are still a common initial infection method for OceanLotus, the group is also actively exploring new ways to compromise victims through diverse supply chain attacks.\\n\\n## Indicators of compromise\\n\\nAdditional information about this activity, including indicators of compromise, is available to customers of the Kaspersky Intelligence Reporting Service. If you are interested, please contact intelreports@kaspersky.com.\\n\\n**Malicious wheel packages** \\n_termncolor-3.1.0-py3-none-any.whl_ \\n5152410aeef667ffaf42d40746af4d84\\n\\n_uuid32_utils-1.x.x-py3-none-xxxx.whl_ \\n0a5a06fa2e74a57fd5ed8e85f04a483a \\ne4a0ad38fd18a0e11199d1c52751908b \\n5598baa59c716590d8841c6312d8349e \\n968782b4feb4236858e3253f77ecf4b0 \\nb55b6e364be44f27e3fecdce5ad69eca \\n02f4701559fc40067e69bb426776a54f \\ne200f2f6a2120286f9056743bc94a49d \\n22538214a3c917ff3b13a9e2035ca521\\n\\n_colorinal-0.1.7-py3-none-xxxx.whl_ \\nba2f1868f2af9e191ebf47a5fab5cbab\\n\\n**Dropper for ZiChatBot** \\n_Backward.dll_ \\nc33782c94c29dd268a42cbe03542bca5 \\n454b85dc32dc8023cd2be04e4501f16a\\n\\n_Backward.so_ \\nfce65c540d8186d9506e2f84c38a57c4 \\n652f4da6c467838957de19eed40d39da\\n\\n_terminate.dll_ \\n1995682d600e329b7833003a01609252\\n\\n_terminate.so_ \\n38b75af6cbdb60127decd59140d10640\\n\\n**ZiChatBot** \\n_libcef.dll_ \\na26019b68ef060e593b8651262cbd0f6″,”published”:”2026-05-06T13:00:34″,”modified”:”2026-05-06T13:00:34″,”type”:”securelist”,”title”:”OceanLotus suspected of using PyPI to deliver ZiChatBot malware”,”source”:””,”references”:””,”id”:”SECURELIST:C46AAD6E697BEE12D62F89019CEB288C”,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/securelist.com\/oceanlotus-suspected-pypi-zichatbot-campaign\/119603\/”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-06T14:05:12″,”description”:”\\n\\n## Introduction\\n\\nThrough our daily threat hunting, we noticed that, beginning in July 2025, a series of malicious wheel packages were uploaded to PyPI (the Python…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,136,7,11,5],"class_list":["post-51695","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-securelist","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n