Threat reportThreat IntelligenceTL-2026-4011
Python .pth Startup Files Abused for Persistence (UPSTYLE backdoor in GlobalProtect CVE-2024-3400 exploitation)
Python .pth Startup Files Abused for Persistence (UPSTYLE (TL-2026-4011), also tracked as UPSTYLE, is a medium-severity tracked intrusion set, first published 2026-10-21. It is attributed to UTA0218 with low confidence, affects Python Software Foundation CPython (site module .pth processing), references 1 CVE (CVE-2024-3400), maps to 12 MITRE ATT&CK techniques (T1003.003, T1021.004, T1027.010), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 1UTA0218
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4011
- Threat ID
- TL-2026-4011
- Also known as
- UPSTYLE, Python startup hooks persistence
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- UTA0218
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Python .pth Startup Files Abused for Persistence (UPSTYLE
Malware and tooling: Python, UPSTYLE, GOST, Netcat
How Python .pth Startup Files Abused for Persistence (UPSTYLE works
Python path-configuration (.pth) files execute any line beginning with 'import' followed by a space or tab each time the interpreter starts, giving attackers a stealthy persistence and execution hook that default tooling rarely inspects. The technique was used in the wild by UTA0218 in the UPSTYLE Python backdoor (update.py writing system.pth) deployed after exploiting Palo Alto PAN-OS GlobalProtect CVE-2024-3400.
Python's site module processes .pth files found in site-packages / dist-packages directories at interpreter start-up. Lines that begin with 'import' followed by a space or tab are passed to exec(), so a single line such as 'import os; os.system(...)' runs arbitrary code whenever any Python process starts or the site module is imported (behavior documented in the Python site module docs; executed lines are supported since Python 3.5 per dfir.ch). Files in a directory are processed in alphabetical order. Interpreter flag -S suppresses the site module and therefore .pth processing; -s disables only the user site-packages directory. Python 3.15 deprecates executing 'import' lines in .pth files (still executed, diagnostic only with -v), with removal planned in later releases; .start files are the documented migration path.
dfir.ch (2025-01-14) analyzes the technique and lists example locations: /usr/lib/python3.6/site-packages/, /usr/local/lib/python3.12/dist-packages/ and the per-user /root/.local/lib/python3.12/site-packages/. The article's researcher test artifact is /usr/local/lib/python3.12/dist-packages/malmoeb.pth. The article notes that default security tooling typically misses .pth persistence and recommends monitoring creation of new (and hidden) .pth files in site-packages directories, and Python -> Bash -> nc process chains. It also points to CPython issue #113659 and the SafeBreach talk 'I'm In Your $PYTHONPATH, Backdooring Your Python Programs' (Itzik Kotler) for the related $PYTHONPATH redirection technique.
Real-world precedent: Volexity (2024-04-12) documented UTA0218, assessed as likely state-backed, exploiting the unauthenticated OS command injection CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect (CVSS 10.0 per vendor/Volexity). Volexity tracked the Python backdoor as UPSTYLE: update.py (MD5 0c1554888ce9ed0da1583dbdf7b31651, SHA256 3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac) is dropped and writes a system.pth (dfir.ch cites /usr/lib/python3.6/site-packages/system.pth) whose base64-encoded payload executes on Python module imports. UPSTYLE parses the nginx error log (sslvpn_ngx_error.log) for attacker-supplied command patterns, executes them, writes output to a bootstrap CSS file, and cleans up artifacts within about 15 seconds; a signal handler protects the component from deletion. Post-exploitation described by Volexity includes cron jobs fetching remote 'policy' files every 60 seconds, reverse shells, firewall configuration exfiltration, the GOST tunneling tool and reverse-SSH, a worldtimeapi.org connectivity beacon, lateral movement over SMB/RDP with compromised service accounts, and theft of Chrome/Edge browser data, NTDS.DIT and DPAPI keys. Volexity's observed timeline: 2024-03-26 reconnaissance (zero-byte file), 2024-04-07 failed backdoor deployment, 2024-04-10 successful exploitation, 2024-04-11 second compromise.
The CVE is referenced context rather than the subject of the dfir.ch article; the technique applies to any host with a Python interpreter and write access to a site directory. No CVSS is assigned to the technique itself.
MITRE ATT&CK techniques used in TL-2026-4011
Credential Access
T1003.003 NTDS; T1555.003 Credentials from Web Browsers
Lateral Movement
Defense Evasion
T1027.010 Command Obfuscation; T1070.004 File Deletion
Persistence
T1053.003 Cron; T1546.018 Python Startup Hooks
Execution
T1059.004 Unix Shell; T1059.006 Python
Command and Control
T1132.001 Standard Encoding; T1572 Protocol Tunneling
Initial Access
T1190 Exploit Public-Facing Application
Privilege Escalation
Affected products and versions in Python .pth Startup Files Abused for Persistence (UPSTYLE
- Python Software Foundation — CPython (site module .pth processing)
Vulnerable versions: 3.5 and later: lines starting with 'import' in .pth files are executed
Fixed in: Behavior is by design; deprecated in 3.15 with later removal - Palo Alto Networks — PAN-OS GlobalProtect (CVE-2024-3400 delivery vector)
Vulnerable versions: 10.2 before 10.2.9-h1; 11.0 before 11.0.4-h1; 11.1 before 11.1.2-h3
Fixed in: 10.2.9-h1; 11.0.4-h1; 11.1.2-h3
Remediation for Python .pth Startup Files Abused for Persistence (UPSTYLE
Patches
- PAN-OS 10.2.9-h1 or later
- PAN-OS 11.0.4-h1 or later
- PAN-OS 11.1.2-h3 or later
Immediate actions
- Hunt for new or modified .pth files in all Python site-packages and dist-packages directories, including hidden files and per-user site directories
- Review .pth files for lines starting with 'import' followed by a space or tab, especially base64 blobs, exec/eval, os.system or subprocess calls
- Alert on Python -> bash/sh -> nc (netcat) process chains
- On PAN-OS GlobalProtect devices, apply the CVE-2024-3400 hotfixes and investigate for UPSTYLE (update.py, system.pth, sslvpn_ngx_error.log abuse)
Workarounds
- Palo Alto Networks Threat Prevention signatures (Threat IDs 95187, 95189, 95191) with vulnerability protection on GlobalProtect interfaces
- Restrict write permissions to Python site-packages/dist-packages directories to trusted administrators
Longer-term hardening
- Baseline and file-integrity-monitor Python site directories on servers, containers and appliances
- Deploy EDR/auditd rules covering file creation of *.pth under python*/site-packages and dist-packages
- Run non-interactive Python services with -I or -S where site customization is not required
- Plan for Python 3.15+ deprecation of executable 'import' lines in .pth files
CVEs associated with Python .pth Startup Files Abused for Persistence (UPSTYLE
Weaknesses (CWE) in Python .pth Startup Files Abused for Persistence (UPSTYLE
Timeline of Python .pth Startup Files Abused for Persistence (UPSTYLE
- Volexity observes UTA0218 initial reconnaissance against a GlobalProtect device (zero-byte file placement)
- Failed backdoor deployment attempt against a GlobalProtect device
- Successful exploitation of CVE-2024-3400 with payload delivery, including the Python-based UPSTYLE backdoor
- Second victim compromised following the same attack pattern
- Palo Alto Networks advisory and Volexity report published; CVE-2024-3400 added to CISA KEV
- dfir.ch publishes analysis of Python .pth files as a persistence mechanism, citing the GlobalProtect backdoor as real-world use
Sources cited for Python .pth Startup Files Abused for Persistence (UPSTYLE
- Analysis of Python's .pth files as a persistence mechanism (dfir.ch)
- Volexity: Zero-Day Exploitation of Unauthenticated RCE Vulnerability in GlobalProtect (CVE-2024-3400)
- Palo Alto Networks Security Advisory CVE-2024-3400
- NVD: CVE-2024-3400
- CISA Known Exploited Vulnerabilities Catalog (CVE-2024-3400 added 2024-04-12)
- Python docs: site - Site-specific configuration hook
- CPython issue #113659
- Centre for Cybersecurity Belgium: CVE-2024-3400 GlobalProtect actively exploited
Detection coverage for TL-2026-4011
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4011 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.