TeamPCP Persistence via Malicious Python .pth Files

The threat actor group TeamPCP has been identified exploiting the Python interpreter's behavior regarding path configuration files (.pth). During the supply chain compromise of the 'litellm' package, the actors embedded malicious .pth files within the package distribution. When these packages are installed, the .pth file is placed into the site-packages or dist-packages directory. The Python interpreter automatically processes these files upon every subsequent invocation, leading to persistent, arbitrary code execution on the compromised host. This technique is particularly effective as it bypasses traditional execution controls and remains active regardless of how the Python application is built or distributed. Defenders should monitor for the correlation between Python process execution and the creation of .pth files in sensitive package directories.

Attack Chain

1. The adversary publishes a malicious version of a legitimate Python package (e.g., 'litellm') to a public repository.
2. A target user installs the malicious package via 'pip' or other standard package managers.
3. The malicious installation script triggers a process (e.g., python.exe) to handle package setup.
4. The installation process writes a malicious .pth file to the target's 'site-packages' or 'dist-packages' directory.
5. The attacker's code inside the .pth file is configured to execute upon Python startup.
6. The victim executes a local Python script or application on the host.
7. The Python interpreter automatically parses the directory, discovers the .pth file, and executes the contained malicious commands.
8. The attacker achieves persistence and potential full control over the compromised environment.

Impact

Successful exploitation results in persistent arbitrary code execution on the target endpoint. Any host that installs the compromised package, including developers and automated CI/CD build environments, becomes infected. This enables data exfiltration, lateral movement, and long-term access to the internal network.

Recommendation

• Enable Sysmon logging for Event ID 1 (Process Creation) and Event ID 11 (File Creation) to capture .pth file modifications.
• Deploy the provided Sigma rule to detect the specific correlation between python.exe activity and .pth file creation.
• Review the contents of any .pth files found in site-packages or dist-packages for suspicious imports or command execution scripts.
• Audit Python environments for unauthorized changes to package installation directories.