# Hermes Stealer: Russian-Market Malware-as-a-Service Platform and PyMapper Distribution Chain

> Hermes is a subscription Windows malware-as-a-service (credential stealer plus interactive remote access) sold on Russian cybercrime forums and delivered via trojanized GitHub repositories using the PyMapper loader chain. Carter Perez (AngelaMos / Lisdex) published a 49-page teardown on 2026-10-24.

- **Published:** 2026-10-30T09:35:02Z
- **Last reviewed:** 2026-10-30T09:35:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4815
- **ID:** TL-2026-4815
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Hermes (Malpedia: win.hermes_stealer) is a commercial Windows malware platform distributed by subscription on Russian-language cybercrime forums. It combines credential theft with interactive remote access managed through a browser-based operator panel (the 'Hermes Panel'). The x64 client harvests credentials and files from Chromium and Gecko browsers, application sessions (Discord, Telegram, Steam), mail clients, cryptocurrency wallets and password managers. It maintains persistence through registry Run keys, scheduled tasks or WMI subscriptions and delivers additional capabilities through separately versioned module DLLs that share a common interface. Operators get persistent WebSocket connections, file transfer, a command shell, clipboard access, input logging and visible/hidden desktop control.

Distribution is via trojanized GitHub repositories containing Python code. Per the report abstract, a repository advertised as an asynchronous scraper concealed a Windows malware loader in its import path; PyMapper supplies the delivery machinery (the report's outline references a manual_mapper.py component) and Hermes is the downstream client. The investigation recovered two delivery routes, an integrated native client, fifteen versioned module binaries and the operator-facing application. Exact binary comparisons tie the PyMapper delivery stages to Hermes. Fourteen flagged files across thirteen repositories were identified, including video tools and purported vulnerability scanners. The report's section outline covers where to find the evidence, how an import leads to a next address, the move from a Python project to Hermes, the native components, laboratory behavior of Hermes, the service around the client, the publishing account, and detection/investigation guidance, with appendices for selected file identities, selected indicators and ATT&CK mappings. One passage references XOR with the 32-byte SHA-256 digest of the payload key.

Limitations: the full report body could not be read in this research pass (report.pdf exceeds the fetch size limit, the 8.5MB paper.pdf returned only PDF structure and section titles, and the OffSeq and Malpedia pages carry no indicators), so no file hashes, domains, IPs, repository names or account names are recorded and no BeaconBeagle lookup was possible. The unrelated malicious PyPI package hermes-px (April 2026) is not confirmed to be the same threat and is excluded. Downstream consumers should pull the report's indicator and ATT&CK appendices directly.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.006 Python
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1546.003 Windows Management Instrumentation Event Subscription
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1005 Data from Local System
- T1071.001 Web Protocols

## Sources

- [Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain (Malpedia library entry)](https://malpedia.caad.fkie.fraunhofer.de/library/224d338f-643f-4bcf-b665-fb81c218fe56/)
- [Vivisection of Hermes - full report (Carter Perez, AngelaMos/Lisdex)](https://papers.lisdex.sh/hermes/report.pdf)
- [Vivisection of Hermes - research paper PDF](https://papers.lisdex.sh/hermes/paper.pdf)
- [Malpedia: win.hermes_stealer family entry](https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes_stealer)
- [OffSeq Radar: Vivisection of Hermes](https://radar.offseq.com/threat/vivisection-of-hermes-an-active-russian-market-malware-as-a-service-platform-and-its-pymapper-f971244616a22bc4)
- [r/Malware discussion: Vivisection of Hermes](https://www.reddit.com/r/Malware/comments/1xf4vgf/vivisection_of_hermes_an_active_russianmarket/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4815