Law Firm Hit by Phish Using Fake Python Runtime

How the Attack Unfolded

The intrusion began with a spear phishing email sent to several staff at a law firm. The message contained a link that routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega, a consumer file-sharing service. Inside the archive was a shortcut file named "Case Documents.lnk" designed to look like legal case materials rather than an executable.

When a user opened the shortcut, it wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, and launched an obfuscated PowerShell chain. This chain prompted the user for administrator rights. Once elevated, the malware created Microsoft Defender exclusions covering a staging directory and the process name python.exe, clearing the way for later payloads to run without triggering alerts.

The Fake Python Runtime

The malware then downloaded a counterfeit Python embedded distribution, including a fake python311.dll, to enable DLL sideloading. This allowed execution of Go-based malicious code, which in turn led to Rust-based backdoors. The archive's filename read "amd96" rather than the correct "amd64," a small inconsistency that a distracted user could easily overlook. The loader supported multiple execution methods, including process ghosting, module stomping, and manual PE mapping, along with several persistence options such as scheduled tasks, WMI event subscriptions, and Startup folder entries.

Why It Succeeded

Several factors combined to make this attack effective:

• A legal-themed pretext that matched the target's daily workflow, increasing the likelihood staff would open the file without hesitation
• Use of a shortcut file rather than an obvious executable, disguising the true nature of the download
• An unexpected administrator-rights prompt disguised as part of viewing a document, which staff approved
• Reliance on GitHub as a command-and-control channel, blending malicious traffic into normal-looking developer service activity

What to Watch For

Defenders and staff should treat several signals as high risk:

• Unexpected "case document" links that lead to encrypted downloads from consumer file-sharing sites
• Shortcut (.lnk) files where a regular document is expected
• Administrator-rights prompts appearing during what should be a simple document review
• Runtime or update downloads with subtle naming inconsistencies, such as an unfamiliar architecture label
• Unexpected GitHub API connections originating from non-browser processes

Building Resistance

Organizations, particularly in legal and professional services, can reduce exposure by training staff to pause on unexpected administrator-rights prompts and verify with IT before approving them. Monitoring for Defender exclusion changes, correlating unusual GitHub API traffic with tasking-file requests, and limiting developer-platform access on non-developer endpoints can help surface this kind of activity before it escalates further.

How did the attack against the law firm start?

It began with a spear phishing email sent to several staff, containing a link that routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega.

What made the fake Python download convincing?

The archive was named to resemble an official Python embedded distribution, though the filename read amd96 rather than amd64, a subtle detail that could be easily missed.

How did the attackers avoid detection?

After gaining administrator rights, the malware created Microsoft Defender exclusions covering a staging directory and the process name python.exe, then used DLL sideloading with a counterfeit python311.dll to run malicious code.

Why did the attackers use GitHub instead of a custom command server?

One backdoor variant assigned each victim a directory in a private GitHub repository holding beacon, command and result files, letting the operator send tasking and transfer files without standing up a custom C2 server.