# Malicious 'pyronut' PyPI Package (Trojanized Pyrogram) Backdoors Telegram Bots with Remote Code Execution

> The malicious PyPI package 'pyronut' (versions 2.0.184, 2.0.185, 2.0.186) is a trojanized copy of the Pyrogram Telegram API framework. It hides a runtime backdoor in Client.start() that gives two hardcoded attacker Telegram accounts remote Python (/e) and shell (/shell) execution on every host running an affected bot. All three versions were quarantined on 2026-03-18.

- **Published:** 2026-10-12T15:01:02Z
- **Last reviewed:** 2026-10-12T15:01:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3366
- **ID:** TL-2026-3366
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Endor Labs identified the PyPI package pyronut as a malicious fork of pyrogram, a popular Telegram API framework with roughly 370,000 monthly downloads. The package copied the legitimate project's description verbatim. The names are too different for classic typosquatting, so the package was most likely promoted through social engineering and community channels. The GitHub repository URL listed in the package metadata was non-functional. Only three versions were ever published (2.0.184, 2.0.185, 2.0.186), all malicious, and all were published, identified and quarantined on 2026-03-18, so the exposure window was a matter of hours.

Unlike many malicious packages, pyronut has no install-time hook. The backdoor runs at application runtime. The actor modified pyrogram/methods/utilities/start.py (around lines 73-78) so that Client.start() imports a hidden module, pyrogram/helpers/secret.py, and calls secret.init_secret(self) inside a bare try/except that fails silently. That call registers two Telegram message handlers that accept commands only from two hardcoded attacker user IDs (1905813501 and 8020909936). The handlers also reject forwarded messages and messages relayed by bots. The backdoor skips installation when the running account is one of the attacker IDs (if client.me.id in OWNERS: return), which indicates deliberate design.

The /e command evaluates attacker-supplied Python in the running client process through the meval library. The code has access to the live pyrogram.Client object, the raw Telegram API layer, and the message and chat objects. Output is returned over Telegram, split at the 4,096-character message limit, with longer output written to a temporary file and sent back as a document. The /shell command passes attacker input directly to /bin/bash -c through subprocess and runs with the privileges of the Python process. Command and control and result delivery both run over Telegram's own infrastructure, so there are no external domains or IPs to block. Detection has to rely on package, file and behavioral artifacts.

Impact: an attacker controlling either ID could run arbitrary code on any server or workstation hosting a bot that imported pyronut, and could read environment variables, API keys, SSH keys, database credentials and Telegram sessions and bot tokens accessible to that process. The source report does not name a threat actor and states no CVE or CVSS score. Checkmarx's separate 'Operation Navy Ghost' reporting describes other trojanized Pyrogram forks that use a similar hardcoded OWNERS-list pattern. However, the BleepingComputer coverage of that campaign does not mention pyronut, so no link between the two is asserted here.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1059.006 Python
- T1059.004 Unix Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication

## Sources

- [Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution (Endor Labs)](https://www.endorlabs.com/learn/malicious-pyronut-package-backdoors-telegram-bots-with-remote-code-execution)
- [Malicious 'Pyronut' Package Backdoors Telegram Bots With Remote Code Execution (Cryptika)](https://www.cryptika.com/malicious-pyronut-package-backdoors-telegram-bots-with-remote-code-execution/)
- [Malicious Pyronut Package Compromises Telegram Bots via RCE (ThreatCluster)](https://threatcluster.io/cluster/malicious-pyronut-package-compromises-telegram-bots-via-rce-0697345c)
- [pyronut malware entity page (ThreatCluster)](https://threatcluster.io/entities/malware/Pyronut)
- [Malicious PyPI packages give hackers control of Telegram bot servers (BleepingComputer; related Operation Navy Ghost reporting, pyronut not named)](https://bleepingcomputer.com/news/security/malicious-pypi-packages-give-hackers-control-of-telegram-bot-servers/)
- [Malware on PyPI Targets Servers Running Telegram Bots (Hackmag)](https://hackmag.com/news/pypi-telegram)
- [Operation Navy Ghost Targets Telegram Bot Developers with Malicious PyPI Packages (ThreatCluster, Checkmarx reporting)](https://threatcluster.io/cluster/checkmarx-explains-fe21a3df)
- [MITRE ATT&CK T1195.002 Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [MITRE ATT&CK T1059.006 Python](https://attack.mitre.org/techniques/T1059/006/)
- [meval on PyPI (dynamic expression evaluation library abused by the backdoor)](https://pypi.org/project/meval/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3366