Iron NetInjector: Turla’s New Malware Loading Tool
Summary: Unit 42 researchers documented IronNetInjector, a toolchain in which IronPython scripts decode and decrypt an embedded .NET injector and payloads, then load the injector via Assembly.Load() and inject the payload into a process such as explorer.exe. The tool uses the Bring Your Own Interpreter method, with two injector variants - NetInjector compiled in 2019 and the more limited PeInjector_x64 compiled in 2018 - and is mostly used to load ComRAT, with one sample carrying an RPC backdoor variant.
What you should know: The scripts rely on an IronPython 2.7.0.40 MSI from 2011 and a scheduled task named PythonUpdateSrvc, so an interpreter already sitting in C:\ProgramData and a task triggered by GroupPolicy or Winlogon events may be all Turla needs to load ComRAT on a host.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026