Threat reportSupply ChainTL-2026-3366
Malicious 'pyronut' PyPI Package (Trojanized Pyrogram) Backdoors Telegram Bots with Remote Code Execution
Malicious 'pyronut' PyPI Package (Trojanized Pyrogram) (TL-2026-3366), also tracked as Trojanized Pyrogram fork, is a high-severity supply-chain compromise, first published 2026-10-12. It has no confirmed attribution, affects PyPI (third-party package) pyronut, maps to 8 MITRE ATT&CK techniques (T1036.005, T1059.004, T1059.006), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3366
- Threat ID
- TL-2026-3366
- Also known as
- Trojanized Pyrogram fork, pyronut backdoor
- Severity
- HIGH
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, telegram bot operators
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Malicious 'pyronut' PyPI Package (Trojanized Pyrogram)
Malware and tooling: Pyronut backdoor, Python, telegram
How Malicious 'pyronut' PyPI Package (Trojanized Pyrogram) works
The malicious PyPI package 'pyronut' (versions 2.0.184, 2.0.185, 2.0.186) is a trojanized copy of the Pyrogram Telegram API framework. It hides a runtime backdoor in Client.start() that gives two hardcoded attacker Telegram accounts remote Python (/e) and shell (/shell) execution on every host running an affected bot. All three versions were quarantined on 2026-03-18.
Endor Labs identified the PyPI package pyronut as a malicious fork of pyrogram, a popular Telegram API framework with roughly 370,000 monthly downloads. The package copied the legitimate project's description verbatim. The names are too different for classic typosquatting, so the package was most likely promoted through social engineering and community channels. The GitHub repository URL listed in the package metadata was non-functional. Only three versions were ever published (2.0.184, 2.0.185, 2.0.186), all malicious, and all were published, identified and quarantined on 2026-03-18, so the exposure window was a matter of hours.
Unlike many malicious packages, pyronut has no install-time hook. The backdoor runs at application runtime. The actor modified pyrogram/methods/utilities/start.py (around lines 73-78) so that Client.start() imports a hidden module, pyrogram/helpers/secret.py, and calls secret.init_secret(self) inside a bare try/except that fails silently. That call registers two Telegram message handlers that accept commands only from two hardcoded attacker user IDs (1905813501 and 8020909936). The handlers also reject forwarded messages and messages relayed by bots. The backdoor skips installation when the running account is one of the attacker IDs (if client.me.id in OWNERS: return), which indicates deliberate design.
The /e command evaluates attacker-supplied Python in the running client process through the meval library. The code has access to the live pyrogram.Client object, the raw Telegram API layer, and the message and chat objects. Output is returned over Telegram, split at the 4,096-character message limit, with longer output written to a temporary file and sent back as a document. The /shell command passes attacker input directly to /bin/bash -c through subprocess and runs with the privileges of the Python process. Command and control and result delivery both run over Telegram's own infrastructure, so there are no external domains or IPs to block. Detection has to rely on package, file and behavioral artifacts.
Impact: an attacker controlling either ID could run arbitrary code on any server or workstation hosting a bot that imported pyronut, and could read environment variables, API keys, SSH keys, database credentials and Telegram sessions and bot tokens accessible to that process. The source report does not name a threat actor and states no CVE or CVSS score. Checkmarx's separate 'Operation Navy Ghost' reporting describes other trojanized Pyrogram forks that use a similar hardcoded OWNERS-list pattern. However, the BleepingComputer coverage of that campaign does not mention pyronut, so no link between the two is asserted here.
MITRE ATT&CK techniques used in TL-2026-3366
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion
Execution
T1059.004 Unix Shell; T1059.006 Python
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Initial Access
T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain
Affected products and versions in Malicious 'pyronut' PyPI Package (Trojanized Pyrogram)
- PyPI (third-party package) — pyronut
Vulnerable versions: 2.0.184; 2.0.185; 2.0.186 - Telegram bot developers — Python Telegram bots built on pyronut (Pyrogram fork)
Vulnerable versions: Any deployment that installed and started a client with pyronut 2.0.184-2.0.186
Fixed in: Reinstall legitimate pyrogram and rotate credentials
Remediation for Malicious 'pyronut' PyPI Package (Trojanized Pyrogram)
Patches
- No patch applies. The versions were quarantined by PyPI. Install the legitimate pyrogram package from its official source.
Immediate actions
- Search requirements.txt, Pipfile, pyproject.toml, setup.py, lock files and installed environments for pyronut 2.0.184, 2.0.185 or 2.0.186
- Uninstall pyronut and rebuild virtual environments or container images from a known-good state
- Treat all environment variables, API keys, SSH keys and database passwords reachable by the affected process as compromised and rotate them
- Revoke all Telegram sessions and Bot API tokens used by affected bots
- Hunt for pyrogram/helpers/secret.py and for /bin/bash -c child processes spawned by Python bot processes
Workarounds
- Block or monitor Telegram traffic from hosts that do not need it
- Audit Client.start() in installed pyrogram code for undocumented imports
Longer-term hardening
- Pin dependencies by hash and verify package names against the upstream project before adding them
- Restrict bot hosts to least privilege and egress-filter where feasible
- Add package-reputation or malicious-package scanning to CI/CD
- Alert on meval appearing in dependency manifests
Weaknesses (CWE) in Malicious 'pyronut' PyPI Package (Trojanized Pyrogram)
Timeline of Malicious 'pyronut' PyPI Package (Trojanized Pyrogram)
- Approximate start (month precision) of the separate Checkmarx-reported 'Operation Navy Ghost' campaign (Nov 2025 - Jun 2026), which used trojanized Pyrogram forks with a similar secret.py helper and hardcoded OWNERS list. No link to pyronut is asserted by the sources.
- Secondary coverage (Cryptika, ThreatCluster) republished the Endor Labs findings the same day, and ThreatCluster created a Pyronut malware entity page.
- Endor Labs published its analysis of the backdoor, covering the /e Python and /shell command execution and the two hardcoded attacker Telegram IDs.
- All three pyronut versions were quarantined on PyPI the same day they were published, giving an exposure window of roughly several hours.
- Endor Labs identified the hidden backdoor module pyrogram/helpers/secret.py and the modified Client.start() in pyronut.
- Malicious pyronut versions 2.0.184, 2.0.185 and 2.0.186 published to PyPI as a trojanized fork of pyrogram.
- The Endor Labs source article was updated, per the hunt record.
Sources cited for Malicious 'pyronut' PyPI Package (Trojanized Pyrogram)
- Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution (Endor Labs)
- Malicious 'Pyronut' Package Backdoors Telegram Bots With Remote Code Execution (Cryptika)
- Malicious Pyronut Package Compromises Telegram Bots via RCE (ThreatCluster)
- pyronut malware entity page (ThreatCluster)
- Malicious PyPI packages give hackers control of Telegram bot servers (BleepingComputer; related Operation Navy Ghost reporting, pyronut not named)
- Malware on PyPI Targets Servers Running Telegram Bots (Hackmag)
- Operation Navy Ghost Targets Telegram Bot Developers with Malicious PyPI Packages (ThreatCluster, Checkmarx reporting)
- MITRE ATT&CK T1195.002 Compromise Software Supply Chain
- MITRE ATT&CK T1059.006 Python
- meval on PyPI (dynamic expression evaluation library abused by the backdoor)
Detection coverage for TL-2026-3366
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3366 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.