TF-MAL-py.masepie

Description

ThreatFox malware family `py.masepie`. Printable name: MASEPIE.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• MalwareBazaar | MasePie - abuse.ch
  web:bazaar.abuse.ch

  Malware samples associated with tag MasePie MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with MasePie . Database Entry

  2026-05-22 05:32 UTC
• APT28 Hacking Collective Targets Ukraine with MASEPIE Malware - CERT-UA ...
  web:dailysecurityreview.com

  To establish persistence on the infected device, MASEPIE modifies the Windows Registry and adds a LNK file with a deceptive name ('SystemUpdate.lnk') to the Windows Startup folder. According to CERT-UA#8399 alert, the malware's primary role is to download additional malware on the infected device and steal data.

  2026-05-22 05:32 UTC
• MASEPIE (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the MASEPIE malware family including references, samples and yara signatures.

  2026-05-22 05:32 UTC
• PDF Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations
  web:media.defense.gov

  MASEPIE Malware In December 2023, APT28 actors wrote MASEPIE[6], a small Python backdoor capable of executing arbitrary commands on victim machines. An FBI investigation revealed that on more than one occasion, APT28 used compromised Ubiquiti EdgeRouters as command-and-control infrastructure for MASEPIE backdoors deployed against targets.

  2026-05-22 05:32 UTC
• APT28 Adversary Activity Detection: New Phishing Attacks Targeting ...
  web:socprime.com

  MASEPIE from the group's adversary toolkit is a Python-based malware with core capabilities designed for file transfer and command execution using TCP protocol. Data is encrypted via the AES-128-CBC algorithm.

  2026-05-22 05:32 UTC
• MASEPIE - threatintelligence.garden.handsomezebra.com
  web:threatintelligence.garden.handsomezebra.com

  MASEPIE Description (BleepingComputer) The links redirect victims to malicious web resources that employ JavaScript to drop a Windows shortcut file (LNK) that launches PowerShell commands to trigger an infection chain for a new Python malware downloader called 'MASEPIE.' MASEPIE establishes persiste...

  2026-05-22 05:32 UTC
• Russian military hackers target Ukraine with new MASEPIE malware
  web:www.bleepingcomputer.com

  Ukraine's Computer Emergency Response Team (CERT) is warning of a new phishing campaign that allowed Russia-linked hackers to deploy previously unseen malware on a network in under one hour.

  2026-05-22 05:32 UTC
• APT28 group targets Ukraine with new MASEPIE malware
  web:www.broadcom.com

  The links redirect victims to malicious web resources that employ JavaScript to drop a Windows shortcut file (LNK) that launches PowerShell commands to trigger an infection chain for a new Python malware downloader called 'MASEPIE.' The malware's primary role is to download additional malware on the infected device and steal data.

  2026-05-22 05:32 UTC
• Russian GRU Targeting Western Logistics Entities and Technology ...
  web:www.cisa.gov

  MASEPIE [8] While other malware variants, such as OCEANMAP and STEELHOOK, [8] were not directly observed targeting logistics or IT entities, their deployment against victims in other sectors in Ukraine and other Western countries suggest that they could be deployed against logistics and IT entities should the need arise.

  2026-05-22 05:32 UTC
• Russian Military Hackers Target Ukraine With New Masepie Malware
  web:www.redpacketsecurity.com

  Ukraine's Computer Emergency Response Team (CERT) is warning of a new phishing campaign that allowed Russia-linked hackers to deploy previously unseen malware on a network in under one hour. APT28, aka Fancy Bear or Strontium, is a Russian state-sponsored threat actor known for targeting government entities, businesses, universities, research institutes, and think tanks in Western countries ...

  2026-05-22 05:32 UTC

Only Available for Registered Users. Sign in to view.