Hackers Hide VIPERTUNNEL Python Backdoor Inside Fake DLL and Obfuscated Loader Chain

Cybersecuritynews •Tushar Subhra Dutta • April 13, 2026

A dangerous Python-based backdoor called VIPERTUNNEL has been quietly making its way into enterprise networks, hiding inside a fake DLL file and using multiple layers of code obfuscation to stay undetected. The malware creates a SOCKS5 proxy tunnel to a remote command-and-control server, giving attackers persistent and stealthy access inside compromised environments. What makes this […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

VIPERTUNNEL Python Backdoor Exploits Fake DLL for Stealth Access A Python backdoor named VIPERTUNNEL is being utilized by hackers to infiltrate enterprise networks. The malware is concealed within a fake DLL file and employs a multi-stage obfuscated loader to evade detection. Once installed, VIPERTUNNEL establishes a SOCKS5 proxy tunnel to a remote command-and-control server, allowing attackers to maintain persistent access to compromised systems. The backdoor's persistence is achieved through a sitecustomize.py file located in C:\ProgramData\cp49s\Lib\, which executes automatically at Python interpreter startup. This method enables the execution of malicious code without user interaction. Organizations are urged to be vigilant as the malware targets enterprise environments, posing a significant risk to network security. Current status indicates ongoing exploitation of this backdoor, with no specific mitigation measures detailed in the articles. 3 sources 65

Extracted Entities

Hackers Hide VIPERTUNNEL Python Backdoor Inside Fake DLL and Obfuscated Loader Chain

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)