OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI | Securelist Dark mode Securelist menu English Russian Spanish Brazil Existing Customers Personal My Kaspersky Renew your product Update your product Customer support Business KSOS portal Kaspersky Business Hub Technical Support Knowledge Base Renew License Home Products Trials&Update Resource Center Kaspersky Next Small Business (1-50 employees) Medium Business (51-999 employees) Enterprise (1000+ employees) Securelist Threats Financial threats Mobile threats Web threats Secure environment (IoT) Vulnerabilities and exploits Spam and Phishing Industrial threats Categories APT reports Incidents Research Malware reports Spam and phishing reports Publications Kaspersky Security Bulletin Archive All Tags APT Logbook Webinars Statistics Encyclopedia Threats descriptions KSB 2021 About Us Company Transparency Corporate News Press Center Careers Sponsorships Policy Blog Contacts Partners Find a Partner Partner Program Content menu Close Subscribe Introduction Technical details Spreading Malicious wheel packages Initial infection Windows version Dropper for ZiChatBot Linux version ZiChatBot Infrastructure Victims Attribution Conclusions Indicators of compromise Authors GReAT Introduction Through our daily threat hunting, we noticed that, beginning in July 2025, a series of malicious wheel packages were uploaded to PyPI (the Python Package Index).
We shared this information with the public security community, and the malware was removed from the repository. We submitted the samples to Kaspersky Threat Attribution Engine (KTAE) for analysis. Based on the results, we believe the packages may be linked to malware discussed in a Threat Intelligence report on OceanLotus. While these wheel packages do implement the features described on their PyPI web pages, their true purpose is to covertly deliver malicious files.
These files can be either .DLL or .SO (Linux shared library), indicating the packages’ ability to target both Windows and Linux platforms. They function as droppers, delivering the final payload – a previously unknown malware family that we have named ZiChatBot . Unlike traditional malware, ZiChatBot does not communicate with a dedicated command and control (C2) server, but instead uses a series of REST APIs from the public team chat app Zulip as its C2 infrastructure.
To conceal the malicious package containing ZiChatBot, the attacker created another benign-looking package that included the malicious package as a dependency. Based on these facts, we confirm that this campaign is a carefully planned and executed PyPI supply chain attack. Technical details Spreading The attacker created three projects on PyPI and uploaded malicious wheel packages designed to imitate popular libraries, tricking users into downloading them.
This is a clear example of a supply chain attack via PyPI. See below for detailed information about the fake libraries and their corresponding wheel packages. Malicious wheel packages The packages added by the attacker and listed on PyPI’s download pages are: uuid32-utils library for generating a 32-character random string as a UUID colorinal library for implementing cross-platform color terminal text termncolor library for ANSI color format for terminal output The key metadata for these packages are as follows: Pip install command File name First upload date Author / Email pip install uuid32-utils uuid32_utils-1.x.x-py3-none-[OS platform].whl 2025-07-16 laz**** / laz****@tutamail.com pip install colorinal colorinal-0.1.7-py3-none-[OS platform].whl 2025-07-22 sym**** / sym****@proton.me pip install termncolor termncolor-3.1.0-py3-none-any.whl Based on the distribution information on the PyPI web page, we can see that it offers X86 and X64 versions for Windows, as well as an x86_64 version for Linux.
The project, for example, provides the following download options: Distribution information of the colorinal project Initial infection libraries employ similar infection chains and malicious payloads. As a result, this analysis will focus on the library as a representative example. A quick look at the code of the third library, termncolor , reveals no apparent malicious content. However, it imports the malicious library as a dependency.
This method allows attackers to deeply conceal malware, making the library appear harmless when distributing it or luring targets. The termncolor library imports the malicious colorinal library During the initial infection stage, the Python code is nearly identical across both Windows and Linux platforms. Here, we analyze the Windows version as an example. Windows version Once a Python user downloads and installs the colorinal-0.1.7-py3-none-win_amd64.whl wheel package file, or installs it using the tool, the ZiChatBot’s dropper (a file named terminate.dll ) will be extracted from the wheel package and placed on the victim’s hard drive.
After that, if the library is imported into the victim’s project, the Python script file at [Python library installation path]\colorinal-0.1.7-py3-none-win_amd64\colorinal\__init__.py will be executed first. The __init__.py script imports the malicious file unicode.py This Python script imports and executes another script located at [python library install path]\colorinal-0.1.7-py3-none-win_amd64\colorinal\unicode.py.
The is_color_supported() function in unicode.py is called immediately. The code loads the dropper into the host Python process The comment in the function states that the highlighted code checks whether the user’s terminal environment supports color. The code actually loads the terminate.dll file into the Python process and then invokes the DLL’s exported function envir , passing the UTF-8-encoded string xterminalunicod as a parameter.
The DLL acts as a dropper, delivering the final payload, ZiChatBot , and then self-deleting. At the end of the function, the script file is also removed. These steps eliminate all malicious files in the library and deploy ZiChatBot . For the Linux platform, the wheel package and the Python script are nearly identical to the Windows version. The only difference is that the dropper file is named “terminate.so”.
Dropper for ZiChatBot From the previous analysis, we learned that the dropper is loaded into the host Python process by a Python script and then activated. The main logic of the dropper is implemented in the envir export function to achieve three objectives: Deploy Establish an auto-run mechanism. Execute shellcode to remove the dropper file (terminate.dll) and the malicious script file from the installed library folder.
The dropper first decrypts sensitive strings using AES in CBC mode. The key is the string-type parameter “xterminalunicode” of the exported function. The decrypted strings are “libcef.dll”, “vcpacket”, “pkt-update”, and “vcpktsvr.exe”. Next, the malware uses the same algorithm to decrypt the embedded data related to ZiChatBot . It then decompresses the decrypted data with LZMA to retrieve the files vcpktsvr.exe libcef.dll associated with ZiChatBot .
The malware creates a folder named vcpacket in the system directory %LOCALAPPDATA% , and places these files into it. To establish persistence for ZiChatBot, the dropper creates the following auto-run entry in the registry: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "pkt-update"="C:\Users\[User name]\AppData\Local\vcpacket\vcpktsvr.exe" [ HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run ] "pkt-update" = "C:\Users\[User name]\AppData\Local\vcpacket\vcpktsvr.exe" Once preparations are complete, the malware uses the XOR algorithm to decrypt the embedded shellcode with the three-byte key 3a7 .
It then searches the decrypted shellcode’s memory for the string Policy.dllcppage.dll and replaces it with its own file name, terminate.dll , and redirects execution to the shellcode’s memory space. The shellcode employs a djb2-like hash method to calculate the names of certain APIs and locate their addresses. Using these APIs, it finds the dropper file with the name that was previously passed by the DLL before unloading and deleting it.
Linux version The Linux version of the dropper places ZiChatBot in the path /tmp/obsHub/obs-check-update and then creates an auto-run job using crontab . Unlike the Windows version, the Linux version of only consists of one ELF executable file. system("chmod +x /tmp/obsHub/obs-check-update") system("echo \"5 * * * * /tmp/obsHub/obs-check-update" | crontab - ") system ( "chmod +x /tmp/obsHub/obs-check-update" ) system ( "echo \"5 * * * * /tmp/obsHub/obs-check-update" crontab The Windows version of ZiChatBot is a DLL file ( libcef.dll ) that is loaded by the legitimate executable (hash: 48be833b0b0ca1ad3cf99c66dc89c3f4).
The DLL contains several export functions, with the malicious code implemented in the cef_api_mash export . Once the DLL is loaded, this function is invoked by the EXE file. ZiChatBot uses the REST APIs from Zulip, a public team chat application, as its command and control server. ZiChatBot is capable of executing shellcode received from the server and only supports this one control command. Once it runs, it initiates a series of sequential HTTP requests to the Zulip REST API.
In each HTTP request, an API authentication token is included as an HTTP header for server-side authentication, as shown below. // Auth token: TW9yaWFuLWJvdEBoZWxwZXIuenVsaXBjaGF0LmNvbTpVOFJFWGxJNktmOHFYQjlyUXpPUEJpSUE0YnJKNThxRw== // Decoded Auth token Morian-bot@helper.zulipchat.com:U8REXlI6Kf8qXB9rQzOPBiIA4brJ58qG 1 2 3 4 5 // Auth token: TW9yaWFuLWJvdEBoZWxwZXIuenVsaXBjaGF0LmNvbTpVOFJFWGxJNktmOHFYQjlyUXpPUEJpSUE0YnJKNThxRw ==
// Decoded Auth token Morian - bot @ helper . zulipchat . com : U8REXlI6Kf8qXB9rQzOPBiIA4brJ58qG ZiChatBot utilizes two separate channel-topic pairs for its operations. One pair transmits current system information, and the other retrieves a message containing shellcode. Once the shellcode is received, a new thread is created to execute it. After executing the command, a heart emoji is sent in response to the original message to indicate the execution was successful.
Infrastructure We did not find any traditional infrastructure, such as compromised servers or commercial VPS services and their associated IPs and domains. Instead, the malicious wheel packages were uploaded to the Python Package Index (PyPI), a public, shared Python library. The malware, ZiChatBot, leverages Zulip’s public team chat REST APIs as its command and control server. The “helper” organization that the attacker had registered on the Zulip service has now been officially deactivated by Zulip.
However, infected devices may still attempt to connect to the service, so to help you locate and cure them, we recommend adding the full URL helper.zulipchat.com to your denylist. Victims The malware was uploaded in July 2025. Upon discovering these attacks, we quickly released an update for our product to detect the relevant files and shared the necessary information with the public security community.
As a result, the malicious software was swiftly removed from PyPI, and the organization registered on the Zulip service was officially deactivated. To date, we have not observed any infections based on our telemetry or public reports. Zulip has officially deactivated the “helper” organization Attribution Based on the results from our KTAE system, the dropper used by ZiChatBot shows a 64% similarity to another dropper we analyzed in a TI report, which was linked to OceanLotus.
Reverse engineering shows that both droppers use nearly identical algorithms and logic for to decrypt and decompress their embedded payloads. Analysis results of dropper using KTAE system Conclusions As an active APT organization, OceanLotus primarily targets victims in the Asia-Pacific region. However, our previous reports have highlighted a growing trend of the group expanding its activities into the Middle East.
Moreover, the attacks described in this report – executed through PyPI – target Python users worldwide. This demonstrates OceanLotus’s ongoing effort to broaden its attack scope. In the first half of 2025, a public report revealed that the group launched a phishing campaign using GitHub. The recent PyPI-based supply chain attack likely continues this strategy. Although phishing emails are still a common initial infection method for OceanLotus, the group is also actively exploring new ways to compromise victims through diverse supply chain attacks.
Indicators of compromise Additional information about this activity, including indicators of compromise, is available to customers of the Kaspersky Intelligence Reporting Service . If you are interested, please contact intelreports@kaspersky.com . 5152410aeef667ffaf42d40746af4d84 uuid32_utils-1.x.x-py3-none-xxxx.whl 0a5a06fa2e74a57fd5ed8e85f04a483a e4a0ad38fd18a0e11199d1c52751908b 5598baa59c716590d8841c6312d8349e 968782b4feb4236858e3253f77ecf4b0 b55b6e364be44f27e3fecdce5ad69eca 02f4701559fc40067e69bb426776a54f e200f2f6a2120286f9056743bc94a49d 22538214a3c917ff3b13a9e2035ca521 colorinal-0.1.7-py3-none-xxxx.whl ba2f1868f2af9e191ebf47a5fab5cbab Backward.dll c33782c94c29dd268a42cbe03542bca5 454b85dc32dc8023cd2be04e4501f16a Backward.so fce65c540d8186d9506e2f84c38a57c4 652f4da6c467838957de19eed40d39da 1995682d600e329b7833003a01609252 terminate.so 38b75af6cbdb60127decd59140d10640 a26019b68ef060e593b8651262cbd0f6 Malware Technologies Targeted attacks Malware Descriptions Malware Supply-chain attack Python OceanLotus OceanLotus suspected of using PyPI to deliver ZiChatBot malware Your email address will not be published.
Required fields are marked * Name Captcha validation failed. Please confirm you are not a robot and try again. Cancel This site uses Akismet to reduce spam. Learn how your comment data is processed. GReAT webinars From the same authors In the same category Latest Posts Latest Webinars Reports Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster.
Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. The Silver Fox group is targeting companies in Russia and India by impersonating tax authorities to distribute ValleyRAT and the new ABCDoor backdoor. Kaspersky researchers analyze updated CoolClient backdoor and new tools and scripts used in HoneyMyte (aka Mustang Panda or Bronze President) APT campaigns, including three variants of a browser data stealer.
The hottest research right in your inbox Email (Required) (Required) I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above. Threats Threats APT (Targeted attacks) All threats Categories Categories Security Bulletin Security technologies All categories Other sections KSB 2025 Kaspersky ICS CERT © 2026 AO Kaspersky Lab.
All Rights Reserved. Registered trademarks and service marks are the property of their respective owners. Privacy Policy Terms of use License Agreement Cookies