Threat reportMalwareTL-2026-4815
Hermes Stealer: Russian-Market Malware-as-a-Service Platform and PyMapper Distribution Chain
Hermes Stealer (TL-2026-4815), also tracked as win.hermes_stealer, is a medium-severity malware campaign, first published 2026-10-30. It has no confirmed attribution, affects Microsoft Windows (x64), maps to 13 MITRE ATT&CK techniques (T1005, T1027, T1053.005), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4815
- Threat ID
- TL-2026-4815
- Also known as
- win.hermes_stealer, Hermes Stealer, PyMapper
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, gaming, software-development, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Hermes Stealer
Malware and tooling: Hermes, Zlader, telegram, win.hermes_stealer, Hermes Panel, PyMapper
How Hermes Stealer works
Hermes is a subscription Windows malware-as-a-service (credential stealer plus interactive remote access) sold on Russian cybercrime forums and delivered via trojanized GitHub repositories using the PyMapper loader chain. Carter Perez (AngelaMos / Lisdex) published a 49-page teardown on 2026-10-24.
Hermes (Malpedia: win.hermes_stealer) is a commercial Windows malware platform distributed by subscription on Russian-language cybercrime forums. It combines credential theft with interactive remote access managed through a browser-based operator panel (the 'Hermes Panel'). The x64 client harvests credentials and files from Chromium and Gecko browsers, application sessions (Discord, Telegram, Steam), mail clients, cryptocurrency wallets and password managers. It maintains persistence through registry Run keys, scheduled tasks or WMI subscriptions and delivers additional capabilities through separately versioned module DLLs that share a common interface. Operators get persistent WebSocket connections, file transfer, a command shell, clipboard access, input logging and visible/hidden desktop control.
Distribution is via trojanized GitHub repositories containing Python code. Per the report abstract, a repository advertised as an asynchronous scraper concealed a Windows malware loader in its import path; PyMapper supplies the delivery machinery (the report's outline references a manual_mapper.py component) and Hermes is the downstream client. The investigation recovered two delivery routes, an integrated native client, fifteen versioned module binaries and the operator-facing application. Exact binary comparisons tie the PyMapper delivery stages to Hermes. Fourteen flagged files across thirteen repositories were identified, including video tools and purported vulnerability scanners. The report's section outline covers where to find the evidence, how an import leads to a next address, the move from a Python project to Hermes, the native components, laboratory behavior of Hermes, the service around the client, the publishing account, and detection/investigation guidance, with appendices for selected file identities, selected indicators and ATT&CK mappings. One passage references XOR with the 32-byte SHA-256 digest of the payload key.
Limitations: the full report body could not be read in this research pass (report.pdf exceeds the fetch size limit, the 8.5MB paper.pdf returned only PDF structure and section titles, and the OffSeq and Malpedia pages carry no indicators), so no file hashes, domains, IPs, repository names or account names are recorded and no BeaconBeagle lookup was possible. The unrelated malicious PyPI package hermes-px (April 2026) is not confirmed to be the same threat and is excluded. Downstream consumers should pull the report's indicator and ATT&CK appendices directly.
MITRE ATT&CK techniques used in TL-2026-4815
Collection
T1005 Data from Local System; T1056.001 Keylogging
Defense Evasion
T1027 Obfuscated Files or Information
Persistence
T1053.005 Scheduled Task; T1546.003 Windows Management Instrumentation Event Subscription; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.003 Windows Command Shell; T1059.006 Python; T1204.002 Malicious File
Command and Control
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Affected products and versions in Hermes Stealer
- Microsoft — Windows (x64)
Vulnerable versions: x64 Windows hosts running the Hermes client
Remediation for Hermes Stealer
Immediate actions
- Do not run code from untrusted GitHub repositories; review imports and install-time hooks before execution
- Hunt for repositories or Python projects whose import path launches a Windows executable or downloads a next-stage address
- Reset credentials and revoke sessions (browser, Discord, Telegram, Steam, mail) on any host that ran a suspect repo
Workarounds
- Application control to block unsigned executables spawned by python.exe
- Egress filtering for unexpected persistent WebSocket connections
Longer-term hardening
- Detect new Run keys, scheduled tasks and WMI event subscriptions created by Python-launched processes
- Isolate developer/analyst workstations used to test third-party code in disposable VMs
- Move crypto wallets and password-manager vaults off hosts that execute untrusted code
Timeline of Hermes Stealer
- Investigation recovers two delivery routes, an integrated native Hermes client, fifteen versioned module binaries and the operator-facing Hermes Panel application, characterizing Hermes as an active subscription MaaS platform sold on Russian-market forums.
- Report documents the PyMapper distribution chain: fourteen flagged files across thirteen GitHub repositories (video tools, purported vulnerability scanners, an async-scraper lure) whose Python import path launches a Windows loader, with exact binary comparisons tying the PyMapper delivery stages to Hermes.
- Malpedia lists a second reference dated 2026-10-24 for the same title, the companion research paper PDF (papers.lisdex.sh/hermes/paper.pdf), alongside the main report.
- Malpedia (Fraunhofer FKIE) adds the report to its library and links it to family win.hermes_stealer.
- Carter Perez (AngelaMos / Lisdex) publishes the 49-page 'Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain'.
- Public secondary coverage (OffSeq Radar) carries no CVEs, hashes, IPs or domains; defenders must obtain indicators and ATT&CK mappings from the report's appendices (papers.lisdex.sh/hermes/report.pdf), which exceeds automated fetch limits.
- OffSeq Radar publishes an AI-generated profile (15:45 UTC) classing Hermes as a Russian-market MaaS platform; it notes no CVEs, hashes, IPs or domains are included and points to the full PDF report for indicators.
- The report is discussed on Reddit r/Malware, the source OffSeq Radar cites for its entry on the Hermes MaaS platform and PyMapper distribution chain.
Sources cited for Hermes Stealer
- Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain (Malpedia library entry)
- Vivisection of Hermes - full report (Carter Perez, AngelaMos/Lisdex)
- Vivisection of Hermes - research paper PDF
- Malpedia: win.hermes_stealer family entry
- OffSeq Radar: Vivisection of Hermes
- r/Malware discussion: Vivisection of Hermes
Detection coverage for TL-2026-4815
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4815 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.