New Python-Based Payload Mecha Flounder Used by Chafer
Summary: In November 2018 the Chafer threat group targeted a Turkish government entity, reusing the domain win10-update[.]com that had appeared in earlier 2018 campaigns reported by Clearsky. Unit 42 identified a previously unreported Python-based secondary payload, tracked as MechaFlounder and compiled with PyInstaller, downloaded as 'lsass.exe' from 185.177.59[.]70 and acting as a backdoor for file upload and download and command execution.
Why it matters: This is the first Python-based payload Unit 42 has seen from Chafer, a group active since at least 2015 and targeting Turkish government entities since at least 2016 - and its code overlaps with OilRig's Clayside VBScript, so a tool built partly from public Stack Overflow snippets is now in the hands of two tracked threat groups.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026