Python-Based PWOBot Targets European Organizations
Summary: Unit 42 Palo Alto Networks identified a malware family called PWOBot, written entirely in Python and compiled with PyInstaller into a Windows executable, that has affected Europe-based organizations, particularly in Poland, with attacks dating back to late 2013 and more recent activity in mid-to-late 2015. PWOBot provides file download and execution, Python code execution, keylogging, an HTTP server, and CPU/GPU cryptocurrency mining, and most samples were downloaded from the Polish file-sharing service chomikuj.pl.
What you should know: There are at least 12 PWOBot variants, and because the underlying code is cross-platform it can be ported to Linux and OSX, while its use of Tor to tunnel traffic to attacker servers should raise alerts for network administrators if seen.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026