← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI
WHITE APT32 Tr1sa111 2026-05-08 Modified: 2026-05-08
37
IOCs
MEDIUM VOLUME
pypidropperwheel packagessupply chain attackpython packageszichatbotzulip c2cross-platform
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
ZiChatBot
Indicators of Compromise (9 / 37 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA1 05391e972db01ed9d55b202b9ae3feec700eabf5 — 2026-05-08
FileHash-SHA1 06adabcb962b5cf5d9fb63542518a5b80b5a9ad4 — 2026-05-08
FileHash-SHA1 1c0a5b35c003ac3182c589c6e014a42678a0647f — 2026-05-08
FileHash-SHA1 67b2e7eb4255f6b990f1bd9917ea54228af2c6a1 — 2026-05-08
FileHash-SHA1 6a8d20cf325b766e69f6133b3a7325034b76948c — 2026-05-08
FileHash-SHA1 8a4a444761ca8836e6022af4a0e86a2be031aaa6 — 2026-05-08
FileHash-SHA1 93708b635f11f182d5541274d0ac7b7d5baf3795 — 2026-05-08
FileHash-SHA1 c7a2684ec7dc6484655e8dfe5b184341c416a3e0 — 2026-05-08
FileHash-SHA1 ccc71ba929add58ad89dff289295659b69ad43a5 — 2026-05-08
References (1)
↗ https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/