{"id":1951,"date":"2025-02-13T10:03:33","date_gmt":"2025-02-13T10:03:33","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/13\/hackers-using-pyramid-pentesting-tool-for-stealthy-c2-communications\/"},"modified":"2025-02-13T10:03:33","modified_gmt":"2025-02-13T10:03:33","slug":"hackers-using-pyramid-pentesting-tool-for-stealthy-c2-communications","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/13\/hackers-using-pyramid-pentesting-tool-for-stealthy-c2-communications\/","title":{"rendered":"Hackers Using Pyramid Pentesting Tool For Stealthy C2 Communications"},"content":{"rendered":"

Hackers Using Pyramid Pentesting Tool For Stealthy C2 Communications
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Hackers have been leveraging the open-source Pyramid pentesting tool to establish stealthy command-and-control (C2) communications.<\/p>\n

Pyramid, first released on GitHub in 2023, is a Python-based post-exploitation framework designed to evade endpoint detection<\/a> and response (EDR) tools.<\/p>\n

Its lightweight HTTP\/S server capabilities make it an attractive choice for malicious actors seeking to minimize detection.<\/p>\n

Pyramid is built on Python\u2019s legitimate presence in many environments, utilizing a Python-based HTTP\/S server to deliver files and act as a C2 server for offensive operations.<\/p>\n

The framework includes modules that load well-known tools like BloodHound, secretsdump, and LaZagne directly into memory.<\/p>\n

Security analysts at Hunt.io identified<\/a> that this in-memory execution allows operators to act within the context of a signed Python interpreter, potentially bypassing traditional endpoint security measures.<\/p>\n

\n
\"\"
Pyramid README Screenshot (Source \u2013 Hunt.io)<\/figcaption><\/figure>\n<\/div>\n

Detection Opportunities<\/strong><\/h2>\n

Identifying Pyramid servers involves analyzing specific network signatures. When interacting with a suspected Pyramid server, the response headers exhibit distinct characteristics:<\/p>\n

Server: BaseHTTP\/0.6 Python\/3.10.4\nDate:\nWWW-Authenticate: Basic realm=\"Demo Realm\"\nContent-Type: application\/json<\/code><\/pre>\n
The server also returns a JSON response body:-<\/p>\n
{\n  \"success\": false,\n  \"error\": \"No auth header received\"\n}<\/code><\/pre>\n
\n
\"\"
Pyramid C2 HTTP 401 Response (Source \u2013 Hunt.io)<\/figcaption><\/figure>\n<\/div>\n
Recent scans have identified several IP addresses associated with Pyramid servers, including 104.238.61[.]144, 92.118.112[.]208, and 45.82.85[.]50.<\/p>\n
These servers were linked to domains resembling DevaGroup, an internet marketing<\/a> service, though no malicious samples have been found yet.<\/p>\n
\n
\"\"
Pyramid C2 Servers Tracked (Source \u2013 Hunt.io)<\/figcaption><\/figure>\n<\/div>\n
Technical Details for Detection:-<\/p>\n