# Operation HumanitarianBait — PyArmor-Packed Python Surveillance Implant Targeting Russian-Speakers via LNK/RAR Lures

> Cyble Research and Intelligence Labs (CRIL) disclosed an active cyberespionage campaign distributing a PyArmor v9.2 Pro-obfuscated, PE-less Python surveillance implant via Russian-language humanitarian-aid LNK lures inside RAR archives. The intrusion chain leverages PowerShell offset extraction, a portable Python 3.12 environment under %APPDATA%\WindowsHelper, attacker-controlled GitHub Releases for payload delivery, and a 5-minute scheduled task for persistence, with credential, cookie, keylog, clipboard, screenshot, file, and Telegram tdata exfiltration plus hidden RustDesk/AnyDesk remote desktop, all routed to 159.198.41.140 (Namecheap VPS, Atlanta).

- **Published:** 2026-05-07T12:00:00Z
- **Last reviewed:** 2026-05-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0474
- **ID:** TL-2026-0474
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation HumanitarianBait is a live cyberespionage campaign first publicly attributed by Cyble's Research and Intelligence Labs (CRIL) on 2026-05-07. The operation distributes a Python-based, PyArmor v9.2 Pro-packed surveillance implant disguised as Russian-language humanitarian aid request forms (e.g., 'O predostavlenii gumanitarnoy pomoshchi' / 'On the provision of humanitarian assistance'), suggesting intended targets are Russian-speaking individuals, NGOs, civil administration, or aid-distribution functions. Cyble could not confidently attribute the activity to a known threat actor at the time of publication.

The initial access vector is a phishing email carrying a RAR archive that contains a malicious Windows LNK shortcut. The LNK uses an anti-sandbox trick: it embeds self-obfuscated Unicode content and a PowerShell command that reads the original LNK from a fixed file offset and executes the extracted payload in memory. If the LNK is detonated outside its original on-disk path (as in many automated sandboxes), the offset read fails and execution is aborted. PowerShell decodes and writes a portable Python 3.12 environment (python-3.12.10-embed-amd64.zip + get-pip.py, both fetched from attacker-controlled GitHub Releases under the account 'leravalera2') to %APPDATA%\WindowsHelper. The malicious Python module 'module.pyw' is fetched from https://github.com/leravalera2/dtfls/releases/download/dtfls/data.zip, packed with PyArmor v9.2 Pro. Two VBScript launchers (run.vbs and launch_module.vbs) wrap pythonw.exe so execution is windowless. Persistence is a Windows Scheduled Task named 'WindowsHelper' that fires every 5 minutes.

Once running, the implant performs comprehensive surveillance: it harvests credentials and cookies from Chromium-family browsers (Chrome, Edge, Brave, Opera, Yandex Browser) — including the v10/v11/v20 (App-Bound Encryption) schemes — and from Firefox, by reading the Local State AES-GCM master key and falling back to DPAPI for legacy stores. It runs a keylogger built on the 'keyboard' Python library, monitors clipboard via 'pyperclip', captures screenshots via 'mss', performs recursive file collection with an SQLite tracker (inventory_state.db) to avoid re-uploading files, scans documents for 64-character hex strings as a private-key heuristic, and exfiltrates Telegram desktop session data ('tdata' folder). The implant also silently downloads and installs RustDesk 1.4.4 (rustdesk-1.4.4-x86_64.exe) and AnyDesk for hidden remote desktop, proxying control sessions via the C2 server's /tunnel endpoint.

The C2 infrastructure is a single Linux VPS at 159.198.41.140 hosted by Namecheap (web-hosting.com, ASN 22612) in Atlanta, GA. The C2 stack is Flask 3.1.3 on Python 3.12.3 fronted by nginx/1.24.0 on Ubuntu Linux. Outbound exfiltration uses /upload; the hidden remote-desktop relay uses /tunnel. The implant spoofs a Chrome 143 / Edge 143 User-Agent. At Cyble's publication date the panel was live and serving an attacker login UI. The campaign's reliance on trusted-infrastructure abuse (GitHub Releases hosting both the legitimate Python embed and the malicious PyArmor payload), combined with PE-less Python execution, App-Bound Encryption defeats, and stealthy commercial RAS deployment, makes it a high-value detection and hunt target for SOCs covering Russian-speaking constituencies and humanitarian organisations.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.006 Command and Scripting Interpreter: Python
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1027.002 Obfuscated Files or Information: Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1564.003 Hide Artifacts: Hidden Window
- T1105 Ingress Tool Transfer
- T1071.001 Application Layer Protocol: Web Protocols
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials in Files
- T1056.001 Input Capture: Keylogging
- T1115 Clipboard Data
- T1113 Screen Capture
- T1005 Data from Local System
- T1021 Remote Services
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1583.006 Acquire Infrastructure: Web Services
- T1608.001 Stage Capabilities: Upload Malware

## Sources

- [Operation HumanitarianBait: An Infostealer Campaign in Disguise](https://cyble.com/blog/operation-humanitarianbait-infostealer-campaign/)
- [Cyble Research and Intelligence Labs RSS Feed (pubDate 2026-05-07T05:14:48Z)](https://cyble.com/feed/)
- [PyArmor — Python source code obfuscator (Pro v9.2)](https://pyarmor.dashingsoft.com/)
- [RustDesk Releases — 1.4.4-x86_64.exe (abused for hidden remote desktop)](https://github.com/rustdesk/rustdesk/releases/tag/1.4.4)
- [MITRE ATT&CK — T1219 Remote Access Software](https://attack.mitre.org/techniques/T1219/)
- [MITRE ATT&CK — T1027.002 Software Packing](https://attack.mitre.org/techniques/T1027/002/)
- [Chromium App-Bound Encryption (v20) — protecting cookies/credentials](https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html)
- [Microsoft Learn — Schtasks.exe and Scheduled Task persistence](https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page)
- [Attacker GitHub account abused for payload distribution](https://github.com/leravalera2)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0474