MalwareUsed by 1 actorExploits 2 CVEs

Peppy

Peppy is a Python-based remote access trojan associated with the Pakistan-linked threat cluster commonly tracked as Transparent Tribe, ProjectM, APT36, Mythic Leopard, and COPPER FIELDSTONE. It has been used in espionage operations primarily targeting Indian diplomatic, government, and military personnel, with reporting also indicating activity focused on Afghanistan. Peppy is part of a broader custom malware ecosystem that includes Crimson RAT and CapraRAT.

Documented Peppy capabilities include screenshot capture, keystroke logging, and automatic exfiltration of files and captured keylogs. These functions support intelligence collection from compromised hosts and align with the group’s long-running surveillance objectives. Peppy has been observed alongside other custom and commodity tooling in campaigns that used staged delivery chains to establish access and then deploy follow-on implants.

Observed delivery activity tied to the broader operator ecosystem includes spearphishing emails with malicious Office documents and macros, watering-hole activity, and use of the Andromeda malware as an initial payload to download and execute additional tools including Peppy. Peppy has been referenced as a custom RAT deployed by Transparent Tribe/COPPER FIELDSTONE in targeted intrusions against South Asian government and military-related victims.

Peppy is associated with Windows-focused intrusion activity, including campaigns that delivered Peppy to victim systems through document-based infection chains and downloader infrastructure. Its role within the operator toolkit is consistent with post-compromise surveillance and collection on infected endpoints.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2010-3333RTF Stack Buffer Overflow Vulnerability in Microsoft OfficeExploited in the wild

"...custom developed tools called Crimson and Peppy..." | "...spear-phishing emails with malicious RTF files exploiting CVE-2010-3333 or CVE-2012-0158..."

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

CVE-2012-0158MSCOMCTL.OCX ActiveX Controls Remote Code ExecutionExploited in the wild

"...custom developed tools called Crimson and Peppy..." | "...spear-phishing emails with malicious RTF files exploiting CVE-2010-3333 or CVE-2012-0158..."

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Transparent Tribe

"...custom developed tools called Crimson and Peppy..."

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

“…rely on both spear-phishing emails and watering hole sites… used a blog… ‘India News Tribe’ … as a watering hole to deliver their payloads.”

T1566.001Spearphishing AttachmentEvidence1

“The ProjectM actors rely on both spear-phishing emails and watering hole sites… ProjectM actors used… spear-phishing emails with malicious RTF files exploiting CVE-2010-3333 or CVE-2012-0158, in addition to Excel files that contained malicious macros…” | “…Excel files that contained malicious macros to download and install their payloads…”

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

Several entries refer generically to command-line interfaces, shell commands, scripting engines, or script execution without always specifying the exact interpreter.

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1203Exploitation for Client ExecutionEvidence1

“…malicious RTF files exploiting CVE-2010-3333 or CVE-2012-0158…”

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

1 technique

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Collection

3 techniques

T1005Data from Local SystemEvidence1

Multiple entries describe identifying files for theft or staging, such as "Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions" and "Peppy can identify specific files for exfiltration."

T1056.001KeyloggingEvidence1

T1113Screen CaptureEvidence3

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence3

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

1 technique

T1020Automated ExfiltrationEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app10 years ago

uri●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Updates - Updates - October 2021 | MITRE ATT&CK®

Enterprise New Software: ... Peppy

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor malware capable of taking screenshots on targeted systems.

securelistNews

Aug 20, 2020

Transparent Tribe: Evolution analysis, part 1

Python-based remote access trojan used by Transparent Tribe alongside Crimson tooling (no additional functional details provided in the content).

palo alto networks unit 42 blogNews

Mar 25, 2016

ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe

Custom Trojan used in the ProjectM toolset; delivered by Andromeda in this campaign and observed using ProjectM-controlled domains for C2.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Peppy