The Reveal Platform
Our analysis identified three malicious versions (1.4.1, 1.4.2, and 1.4.3) of Microsoft’s DurableTask Python package published on PyPI. The compromised packages contained malicious code embedded within multiple __init__.py files, enabling automatic execution whenever the package was imported. By leveraging a trusted open-source package, the attackers gained an effective distribution mechanism capable of targeting developer workstations, cloud environments, and CI/CD ecosystems.
The embedded code downloads and executes a second-stage payload, rope.pyz, from attacker-controlled infrastructure. Analysis of the payload revealed a sophisticated and modular credential harvesting framework designed to collect sensitive information from a wide range of enterprise technologies, including AWS, Azure, Google Cloud Platform (GCP), GitHub, Kubernetes, HashiCorp Vault, and popular password managers. The malware also harvests locally stored secrets such as SSH keys, Docker credentials, environment files, VPN configurations, and authentication tokens.
Beyond credential theft, the malware incorporates multiple capabilities intended to maintain access and increase operational resilience. These include Systemd-based persistence, environment and geolocation checks, encrypted command-and-control (C2) discovery through the FIRESCALE mechanism, and multiple exfiltration fallback channels. Our analysis also identified geo-targeted destructive functionality capable of deleting files on systems that match specific regional criteria, significantly increasing the potential impact of compromise.
Analysis of the campaign infrastructure revealed that the secondary command-and-control (C2) domain, t.m-kosche[.]com, overlaps with infrastructure previously associated with TeamPCP’s Mini Shai-Hulud campaign. The same threat actor has been linked to several high-profile software supply chain compromises targeting organizations and open-source projects throughout 2026, including TanStack, Mistral AI, LiteLLM, and AntV. Based on the observed infrastructure overlap, malware functionality, and tradecraft similarities, we assess with high confidence that the DurableTask compromise is part of the broader TeamPCP supply chain operation.
The breadth of credential sources targeted by the malware indicates a strong focus on gaining access to cloud infrastructure, development environments, source code repositories, and privileged secrets. The compromise of DurableTask represents another significant addition to TeamPCP’s rapidly expanding supply chain campaign and demonstrates the continued effectiveness of abusing trusted software ecosystems to achieve large-scale credential theft and downstream compromise.
In this report, we examine the infection chain, persistence mechanisms, credential collection modules, command-and-control infrastructure, exfiltration techniques, and detection opportunities associated with the malicious DurableTask packages, providing defenders with the technical insights needed to identify and respond to potential compromise.
Fig 1 : Malicious package was later removed by PyPI
Fig 2 : Malware Setup contains url belongs to TeamPCP
Fig 3 : Collector Module
As part of our threat research efforts, we analyzed the malicious DurableTask package versions published on PyPI and performed a detailed examination of the associated second-stage payload (rope.pyz). Our investigation focused on execution flow, persistence mechanisms, credential theft capabilities, command-and-control communications, and exfiltration behavior.
The findings presented in this report are based on static analysis of the malicious package contents and the retrieved payload components.
The attack begins when a victim installs one of the compromised DurableTask package versions.
The attackers modified multiple package initialization files (__init__.py) to ensure malicious code execution whenever the package is imported. Upon execution, the malicious code retrieves a second-stage payload (rope.pyz) from attacker-controlled infrastructure and launches it locally.
The second-stage payload performs environment validation checks, establishes persistence, collects credentials from multiple sources, and exfiltrates the harvested data using several fallback mechanisms.
__init__pyrope.pyzThe malicious package contains injected code within multiple initialization files:
When imported, the malicious code downloads a second-stage payload from:
The payload is written to:
and subsequently executed using Python.
By embedding the malicious code within initialization files, the attackers ensure execution occurs automatically during normal package usage without requiring user interaction.
Fig 4 : Stage 1 payload _init_.py
The downloaded payload performs several checks before proceeding with execution.
Analysis of the __main__.py module shows validation logic that evaluates:
Systems matching predefined exclusion criteria are prevented from continuing execution. Such checks are commonly used to avoid execution in analyst environments, automated sandboxes, or specific geographic regions.
Fig 5 : Checking System,Language and CPU count
Fig 6 : _main_.py launching entrypoint module
The malware establishes persistence through Systemd service creation.
The persistence logic determines whether the process is running under a privileged account and generates appropriate service definitions to ensure execution following system reboot.
This mechanism provides long-term access to compromised systems.
Fig 7 : Python deployment and Persistence mechanism
The malware performs additional checks using:
The code specifically evaluates indicators associated with Israel and Iran.
Fig 8 : Checking if Israel System
Our analysis identified destructive logic capable of deleting files from systems that match specific regional conditions.
While the primary objective of the malware appears to be credential theft, the inclusion of destructive capabilities significantly increases the potential impact of compromise.
Organizations operating in affected regions should consider this functionality when assessing exposure and incident response requirements.
Fig 9 : Geo Targeted destruction
The malware searches harvested data for GitHub Personal Access Tokens (PATs), including patterns such as:
Recovered tokens are used to authenticate directly to the GitHub API.
Our analysis shows the malware can create repositories under victim-owned GitHub accounts, providing attackers with an alternative mechanism for data storage, communication, or operational persistence.
Fig 10 : Github token theft and public repository creation
Fig 11 : Displays Github Repository created
The malware implements a resilient command-and-control discovery mechanism referred to internally as FIRESCALE.
Rather than relying exclusively on hardcoded infrastructure, the malware searches GitHub commit messages containing specially formatted FIRESCALE markers. These markers contain Base64-encoded and cryptographically signed infrastructure information.
After validating the embedded signature using a hardcoded public key, the malware extracts a trusted fallback command-and-control address.
This design allows attackers to rotate infrastructure while maintaining communication with infected systems.
Fig 12 : FIRESCALE Fallback
Collected information is converted into JSON format and transmitted to attacker-controlled infrastructure using HTTP POST requests.
The malware implements multiple fallback mechanisms to maximize exfiltration reliability. If the primary communication channel becomes unavailable, the malware attempts alternate destinations, including GitHub-based methods.
Fig 13 : Sending JSON Data to a Remote Server via HTTP POST
The malware contains a modular collection framework designed to aggregate credentials from multiple enterprise platforms and development environments.
The collection process prioritizes exfiltration through:
Fig 14 : Credential Aggregator
Here Credential aggregator is checking and requesting for Early quarantine URL from config.py, if response is 200 then reads and decodes the payload. Decoded payload then it will send to roulette.collect
Fig 15 : Collecting Credential from all sources
Fig 16 : Credential aggregator completed
The malware contains dedicated modules targeting cloud infrastructure credentials and authentication tokens across AWS, Azure, and Google Cloud environments. The collected credentials can provide attackers with direct access to cloud resources, management interfaces, and sensitive workloads.
The malware attempts to retrieve temporary credentials from AWS EC2 Instance Metadata Service (IMDS). When an IAM role is attached to an EC2 instance, the malware can obtain:
Compromising these credentials allows attackers to authenticate as the instance role and access AWS resources according to assigned permissions.
Fig 17 : AWS Credentials
Beyond IMDS, the malware searches local AWS configuration and credential files to extract:
These credentials may provide broader access than instance roles and enable lateral movement across AWS environments.
Fig 18 : Profiles and Regions
The malware contains functionality for interacting with AWS Systems Manager (SSM). Analysis shows it constructs authenticated requests to regional SSM endpoints and processes returned responses.
This capability may allow attackers to enumerate managed systems or leverage compromised credentials for additional reconnaissance.
Fig 19 : AWS System Manager (SSM)
The malware aggregates discovered AWS credentials and profile information into a centralized structure for subsequent exfiltration.
Fig 20 : Collection of Profile names, Access key id, secret key, tokens
The malware specifically targets password managers commonly used by developers and administrators, including:
Successful compromise of these platforms may expose credentials beyond the initially infected system.
The malware searches environment variables and shell history files for password-related artifacts.
Fig 21 : Discovering Password from Environments and History files
The malware attempts to leverage available CLI tools to unlock password vaults and recover stored secrets.
Fig 22 : Unlocking password manager Bitwarden and onepassword
Fig 23 : Unlocking gpg password manager
Recovered credentials are aggregated and prepared for exfiltration.
Fig 24 : Password extraction from gopass
Fig 25 : Password extraction from onepassword
Fig 26 : Password extraction from botwarden
The malware collects Azure authentication artifacts from:
These tokens may allow attackers to access Azure subscriptions and resources.
Fig 27 : Azure Access tokens
The malware attempts to identify:
Successful collection may expose sensitive credentials, certificates, and application secrets.
Fig 28 : Subscription ID, Key Vaults and Secrets of key vaults
Collected Azure tokens and associated metadata are aggregated for exfiltration.
Fig 29 : Collection of all azure tokens
The malware targets Google Cloud credentials from:
Recovered access tokens may provide direct access to cloud workloads and services.
Fig 30 : Tokens from Google cloud platforms
The malware attempts to collect Kubernetes secrets through multiple access methods:
The code also contains logic suggesting potential access to additional pods and cluster resources.
Compromise of Kubernetes secrets may expose application credentials, service account tokens, certificates, and cloud access keys.
Fig 31 : Kubernetes secrets
The malware consolidates sensitive information from numerous local sources, including:
This module acts as a centralized collector for locally stored secrets.
Fig 32 : Filesystem
Fig 33 : Central Collector
The malware attempts to retrieve Vault authentication tokens through multiple methods:
Successful compromise may provide access to centrally managed enterprise secrets.
Fig 34 : Vault Authentication Tokens
It attempts to obtain a Vault authentication token from environment variables, local token files, AppRole credentials, or the Vault CLI.
| Package | Version |
| DurableTask | 1.4.1 |
| DurableTask | 1.4.2 |
| DurableTask | 1.4.3 |
| Artifact | Description |
| /tmp/managed.pyz | Downloaded second-stage payload executed by the compromised package |
| File | SHA256 |
| __init__.py. | 219c72d7955b6e1341e527bfca83d29d91feac6ae192529ec8798aa5325e4618 |
| rope.pyz | 069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce |
| Technique | ATT&CK ID |
| Supply Chain Compromise | T1195 |
| Ingress Tool Transfer | T1105 |
| Systemd Service Persistence | T1543.002 |
| Credentials from Password Stores | T1555 |
| Credentials in Files | T1552.001 |
| Steal Application Access Token | T1528 |
| System Location Discovery | T1614 |
| Exfiltration Over C2 Channel | T1041 |
| Data Destruction | T1485 |
Monitor for:
/tmpMonitor communications involving:
Investigate outbound HTTP POST requests containing large JSON payloads originating from developer systems.
Hunt for:
Gurucul SIEM can correlate package installation activity, Python execution, cloud credential access, persistence creation, and outbound communications to identify potentially compromised systems.
Behavioral analytics can identify anomalous access to cloud resources, GitHub repositories, Kubernetes environments, and Vault deployments originating from developer workstations.
Known domains, URLs, hashes, and infrastructure indicators associated with the campaign can be continuously monitored to identify compromise activity.
Threat hunters can proactively search for persistence artifacts, credential harvesting behavior, GitHub token abuse, and suspicious cloud administration activity.
Gurucul can correlate process, network, authentication, and cloud telemetry to reconstruct the attack chain and assess the scope of credential exposure.
Our investigation of the malicious DurableTask packages revealed a sophisticated multi-stage supply chain attack targeting cloud-native and developer-centric environments. Beyond credential theft, the malware incorporates persistence mechanisms, multi-cloud credential collection, GitHub token abuse, Kubernetes and Vault targeting, resilient command-and-control discovery, and geo-targeted destructive functionality.
The breadth of credential sources targeted by the malware indicates a strong focus on gaining access to cloud infrastructure, development environments, and privileged secrets. Organizations that installed the affected package versions should conduct a thorough compromise assessment, rotate exposed credentials, and review access to cloud, GitHub, Kubernetes, and Vault environments.
This incident highlights the continued risk posed by software supply chain attacks and reinforces the need for dependency monitoring, package validation, and continuous detection capabilities across developer ecosystems.
Contributors:
Abhishek Samdole
Rudra Pratap
