← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI
WHITE APT32 Tr1sa111 2026-05-08 Modified: 2026-05-08
37
IOCs
MEDIUM VOLUME
pypidropperwheel packagessupply chain attackpython packageszichatbotzulip c2cross-platform
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
ZiChatBot
Indicators of Compromise (18 / 37 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 02f4701559fc40067e69bb426776a54f — 2026-05-08
FileHash-MD5 0a5a06fa2e74a57fd5ed8e85f04a483a — 2026-05-08
FileHash-MD5 1995682d600e329b7833003a01609252 — 2026-05-08
FileHash-MD5 22538214a3c917ff3b13a9e2035ca521 — 2026-05-08
FileHash-MD5 38b75af6cbdb60127decd59140d10640 — 2026-05-08
FileHash-MD5 454b85dc32dc8023cd2be04e4501f16a — 2026-05-08
FileHash-MD5 48be833b0b0ca1ad3cf99c66dc89c3f4 — 2026-05-08
FileHash-MD5 5152410aeef667ffaf42d40746af4d84 — 2026-05-08
FileHash-MD5 5598baa59c716590d8841c6312d8349e — 2026-05-08
FileHash-MD5 652f4da6c467838957de19eed40d39da — 2026-05-08
FileHash-MD5 968782b4feb4236858e3253f77ecf4b0 — 2026-05-08
FileHash-MD5 a26019b68ef060e593b8651262cbd0f6 — 2026-05-08
FileHash-MD5 b55b6e364be44f27e3fecdce5ad69eca — 2026-05-08
FileHash-MD5 ba2f1868f2af9e191ebf47a5fab5cbab — 2026-05-08
FileHash-MD5 c33782c94c29dd268a42cbe03542bca5 — 2026-05-08
FileHash-MD5 e200f2f6a2120286f9056743bc94a49d — 2026-05-08
FileHash-MD5 e4a0ad38fd18a0e11199d1c52751908b — 2026-05-08
FileHash-MD5 fce65c540d8186d9506e2f84c38a57c4 — 2026-05-08
References (1)
↗ https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/