Severity: HighThreat AdvisoryPublished 2026-10-28 · TLP:CLEAR

Hermes Malware-as-a-Service: PyMapper supply-chain delivery

A commercial Windows credential-stealer and remote-access platform sold on Russian-language forums — “Hermes” — is being delivered through trojanized Python packages on GitHub disguised as scrapers, security tools and crypto utilities. Two delivery chains converge on the same downloader, LOLD. AmonSul Threat Intelligence extracted and normalized the indicators into a free STIX 2.1 bundle you can load into your stack today.

Download free STIX 2.1 bundleCheck if you’re affected
STIX indicators
165
C2 / infra IPs
32
File hashes
119
ATT&CK techniques
44

Delivery chain

  1. A trojanized GitHub repo (scraper, security tool or crypto utility) imports an obfuscated loader before the advertised code runs.
  2. Long route: Python mapper → encoded Windows package → native decryption loader → LOLD downloader.
  3. Short route: LOLD is embedded directly in the Python package.
  4. LOLD fetches the Hermes client from an operator-controlled server; the config key is recoverable per carrier.
  5. Hermes sets persistence, harvests credentials and gives the operator interactive remote access through a web panel.

MITRE ATT&CK coverage (selected)

  • T1105 Ingress Tool Transfer
  • T1059.001/.003/.006 Command & Scripting
  • T1547.001 Run Key Persistence
  • T1055 Process Injection
  • T1555.003 Browser Credentials
  • T1620 Reflective Code Loading
  • T1071.001 Web Protocol C2

Representative indicators

# C2 / report endpoints
194.102.104.223:8093
194.102.104.223:8700
109.238.87.128:8700
85.121.179.7:8000

# distribution
github.com/unknown-person00lie/KawaiiGPT.git
t.me/Hermes_Greece

# persistence (mutex)
Local\Lold_<8-digit-id>

# registry
HKCU\...\CurrentVersion\Run
HKCU\Software\DesktopStreamClient\*

The full set — 165 indicators across IPs, domains, URLs and file hashes — is in the STIX bundle. Indicators marked not-for-blocking are context only: do not block them.

Recommended actions

  • Block the C2 IPs and domains at proxy and firewall, pending your own validation.
  • Hunt endpoints for the Local\Lold_<id> mutex and the listed registry keys.
  • Audit CI/CD runners and developer machines for recently pulled GitHub Python packages matching this profile.
  • Load the full STIX bundle into your SIEM, EDR and TIP (MISP / OpenCTI) and alert on matches.

Evidence note. Indicators are drawn from the source research “Vivisection of Hermes” (Carter Perez / AngelaMos, 2026-10-24), extracted and normalized by AmonSul Threat Intelligence. Confidence is moderate (60/100) pending your own re-verification. CVE-2026-41940, referenced in the source, has not been independently confirmed.

Is Hermes already inside your network?

Our MDR and incident-response analysts hunt for these indicators every day. Book a threat assessment and we’ll check your exposure — developer endpoints and CI/CD included.

Book a threat assessmentManaged Detection & Response