Operation HumanitarianBait — PyArmor-Packed Python Surveillance Implant Targeting Russian-Speakers via LNK/RAR Lures
Operation HumanitarianBait (TL-2026-0474), also tracked as Operation HumanitarianBait, is a high-severity malware campaign, first published 2026-05-07. It has no confirmed attribution, affects Microsoft Windows, maps to 24 MITRE ATT&CK techniques (T1005, T1021, T1027.002), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-0474
- Threat ID
- TL-2026-0474
- Also known as
- Operation HumanitarianBait, HumanitarianBait, WindowsHelper Implant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-07
- Last reviewed
- 2026-05-07
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- humanitarian aid, non-profit, civil administration, government, ngo
- Target regions
- Russia, Russian-speaking regions, CIS
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Operation HumanitarianBait
Malware and tooling: AnyDesk, Custom Flask 3.1.3 panel on Python 3.12.3 / nginx 1.24.0 / Ubuntu, PyArmor v9.2 Pro, RustDesk
Cyble Research and Intelligence Labs (CRIL) disclosed an active cyberespionage campaign distributing a PyArmor v9.2 Pro-obfuscated, PE-less Python surveillance implant via Russian-language humanitarian-aid LNK lures inside RAR archives. The intrusion chain leverages PowerShell offset extraction, a portable Python 3.12 environment under %APPDATA%\WindowsHelper, attacker-controlled GitHub Releases for payload delivery, and a 5-minute scheduled task for persistence, with credential, cookie, keylog, clipboard, screenshot, file, and Telegram tdata exfiltration plus hidden RustDesk/AnyDesk remote desktop, all routed to 159.198.41.140 (Namecheap VPS, Atlanta).
How Operation HumanitarianBait works
Operation HumanitarianBait is a live cyberespionage campaign first publicly attributed by Cyble's Research and Intelligence Labs (CRIL) on 2026-05-07. The operation distributes a Python-based, PyArmor v9.2 Pro-packed surveillance implant disguised as Russian-language humanitarian aid request forms (e.g., 'O predostavlenii gumanitarnoy pomoshchi' / 'On the provision of humanitarian assistance'), suggesting intended targets are Russian-speaking individuals, NGOs, civil administration, or aid-distribution functions. Cyble could not confidently attribute the activity to a known threat actor at the time of publication.
The initial access vector is a phishing email carrying a RAR archive that contains a malicious Windows LNK shortcut. The LNK uses an anti-sandbox trick: it embeds self-obfuscated Unicode content and a PowerShell command that reads the original LNK from a fixed file offset and executes the extracted payload in memory. If the LNK is detonated outside its original on-disk path (as in many automated sandboxes), the offset read fails and execution is aborted. PowerShell decodes and writes a portable Python 3.12 environment (python-3.12.10-embed-amd64.zip + get-pip.py, both fetched from attacker-controlled GitHub Releases under the account 'leravalera2') to %APPDATA%\WindowsHelper. The malicious Python module 'module.pyw' is fetched from https://github.com/leravalera2/dtfls/releases/download/dtfls/data.zip, packed with PyArmor v9.2 Pro. Two VBScript launchers (run.vbs and launch_module.vbs) wrap pythonw.exe so execution is windowless. Persistence is a Windows Scheduled Task named 'WindowsHelper' that fires every 5 minutes.
Once running, the implant performs comprehensive surveillance: it harvests credentials and cookies from Chromium-family browsers (Chrome, Edge, Brave, Opera, Yandex Browser) — including the v10/v11/v20 (App-Bound Encryption) schemes — and from Firefox, by reading the Local State AES-GCM master key and falling back to DPAPI for legacy stores. It runs a keylogger built on the 'keyboard' Python library, monitors clipboard via 'pyperclip', captures screenshots via 'mss', performs recursive file collection with an SQLite tracker (inventory_state.db) to avoid re-uploading files, scans documents for 64-character hex strings as a private-key heuristic, and exfiltrates Telegram desktop session data ('tdata' folder). The implant also silently downloads and installs RustDesk 1.4.4 (rustdesk-1.4.4-x86_64.exe) and AnyDesk for hidden remote desktop, proxying control sessions via the C2 server's /tunnel endpoint.
The C2 infrastructure is a single Linux VPS at 159.198.41.140 hosted by Namecheap (web-hosting.com, ASN 22612) in Atlanta, GA. The C2 stack is Flask 3.1.3 on Python 3.12.3 fronted by nginx/1.24.0 on Ubuntu Linux. Outbound exfiltration uses /upload; the hidden remote-desktop relay uses /tunnel. The implant spoofs a Chrome 143 / Edge 143 User-Agent. At Cyble's publication date the panel was live and serving an attacker login UI. The campaign's reliance on trusted-infrastructure abuse (GitHub Releases hosting both the legitimate Python embed and the malicious PyArmor payload), combined with PE-less Python execution, App-Bound Encryption defeats, and stealthy commercial RAS deployment, makes it a high-value detection and hunt target for SOCs covering Russian-speaking constituencies and humanitarian organisations.
MITRE ATT&CK techniques used in TL-2026-0474
Collection
T1005 Data from Local System; T1056.001 Input Capture: Keylogging; T1113 Screen Capture; T1115 Clipboard Data
Lateral Movement
Defense Evasion
T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1564.003 Hide Artifacts: Hidden Window
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.006 Command and Scripting Interpreter: Python; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials in Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Initial Access
T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment
Resource Development
T1583.006 Acquire Infrastructure: Web Services; T1608.001 Stage Capabilities: Upload Malware
Affected products and versions in Operation HumanitarianBait
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2019; Server 2022 - Google — Chrome (App-Bound Encryption v10/v11/v20)
Vulnerable versions: all current - Mozilla — Firefox
Vulnerable versions: all current - Telegram FZ-LLC — Telegram Desktop (tdata session storage)
Vulnerable versions: all current - RustDesk — RustDesk
Vulnerable versions: 1.4.4 abused, all current - AnyDesk Software — AnyDesk
Vulnerable versions: all current
Remediation for Operation HumanitarianBait
Immediate actions
- Block outbound traffic to 159.198.41.140 at perimeter firewalls and proxies
- Block downloads from github.com/leravalera2/* across web proxies and DLP
- Hunt for scheduled tasks named 'WindowsHelper' and for %APPDATA%\WindowsHelper directories on all endpoints
- Quarantine and re-image hosts where module.pyw, run.vbs, or launch_module.vbs are present in %APPDATA%\WindowsHelper
- Force-reset credentials saved in Chromium and Firefox profiles on any host showing pythonw.exe spawned from %APPDATA%\WindowsHelper
- Invalidate Telegram sessions for users whose tdata folder may have been harvested
Workarounds
- Disable automatic LNK execution from extracted RAR archives via policy
- Configure Outlook/Exchange to strip or quarantine RAR attachments containing LNK files
- Enable Microsoft Defender SmartScreen and Mark-of-the-Web enforcement on archive extraction tools
Longer-term hardening
- Deploy EDR detections for pythonw.exe parented by VBScript wscript.exe / cscript.exe
- Alert on Scheduled Task creation invoking pythonw.exe or VBS launchers from user profile directories
- Block or alert on PowerShell reading from LNK file offsets (Get-Content with -Encoding Byte and large offsets)
- Restrict execution of pythonw.exe / python.exe from %APPDATA% via AppLocker or WDAC
- Block silent installs of RustDesk and AnyDesk from non-IT-managed processes; require PAM approval for any RAS install
Weaknesses (CWE) in Operation HumanitarianBait
CWE-506, CWE-829, CWE-94
Timeline of Operation HumanitarianBait
- Attacker-controlled GitHub account 'leravalera2' staged with the 'dtfls' repository hosting both clean Python 3.12.10 embed runtime and the PyArmor-packed module.pyw payload (data.zip) — earliest plausible staging window before Cyble disclosure.
- Phishing emails delivering RAR archives with Russian-language humanitarian aid LNK lures observed in the wild; Dementyeva_Anna_Vasilyevna_zayavka_gumanitarnayapomosch.rar (SHA-256 9be61c95056fd6b63565cf51a196f2615f5360c0a42e616b2a618473e9d60a21) submitted/observed.
- C2 server 159.198.41.140 (Namecheap VPS, Atlanta, ASN 22612) observed actively serving lure PDF (/static/builder/lnk_uploads/invo.pdf), survey lure (/test/index.php?r=survey/index), /upload exfiltration endpoint, and /tunnel RustDesk relay endpoint.
- Threadlinqs Intelligence ingested the campaign as TL-2026-0474 from the Cyble RSS feed (pubDate 2026-05-07T05:14:48Z); Researcher began deep analysis and D1 documentation.
- At Cyble's publication time the C2 panel at hxxp://159.198.41.140 was confirmed live, serving an attacker login UI on nginx/1.24.0 with a Flask 3.1.3 / Python 3.12.3 backend on Ubuntu Linux.
- Cyble Research and Intelligence Labs (CRIL) publishes 'Operation HumanitarianBait: An Infostealer Campaign in Disguise', releasing 3 SHA-256 IOCs, the C2 IPv4, 3 attacker URLs, attribution analysis, and a 19-technique ATT&CK mapping.
- As of 2026-05-29, Operation HumanitarianBait remains a live, evolving cyberespionage campaign: Cyble and follow-up reporting (through mid-May 2026) confirm the C2 at 159.198.41.140 is operational and the leravalera2 GitHub Releases payloads are being frequently updated. No takedown, GitHub suspension, sinkhole, or attribution has emerged, and a new survey-based lure variant shows active operator refinement.
Sources cited for Operation HumanitarianBait
- Operation HumanitarianBait: An Infostealer Campaign in Disguise
- Cyble Research and Intelligence Labs RSS Feed (pubDate 2026-05-07T05:14:48Z)
- PyArmor — Python source code obfuscator (Pro v9.2)
- RustDesk Releases — 1.4.4-x86_64.exe (abused for hidden remote desktop)
- MITRE ATT&CK — T1219 Remote Access Software
- MITRE ATT&CK — T1027.002 Software Packing
- Chromium App-Bound Encryption (v20) — protecting cookies/credentials
- Microsoft Learn — Schtasks.exe and Scheduled Task persistence
- Attacker GitHub account abused for payload distribution
Threats related to Operation HumanitarianBait
- Armored Likho APT Deploys BusySnake Python Stealer with PyArmor Obfuscation Against Government and Power Infrastructure Targets
- Armored Likho APT Targets Government and Power Sector with New BusySnake Stealer via CVE-2025-9491 LNK Abuse
- Armored Likho APT (Eagle Werewolf) Deploys AI-Generated Loaders to Drop BusySnake Python Stealer Against Government and Power-Sector Targets
- Edgecution: Payouts King Initial Access Broker Deploys Malicious Microsoft Edge Extension with Embedded Python Backdoor
- Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys QuasarRAT, UltraVNC and Updated Notifier Backdoor
Detection coverage for TL-2026-0474
As of 2026-05-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0474 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.