This tool, originally open-sourced on GitHub in 2022, has only recently gained traction among threat actors, leveraging Python to deploy various malicious payloads directly into memory without leaving traditional forensic traces on compromised systems. Most alarmingly, the tool has been connected to several ransomware operations including Rhysida, Vice Society, and BlackCat, suggesting it has become a preferred component in sophisticated attack chains. Intrinsec researchers identified a concerning pattern of IP addresses associated with Eye Pyramid command and control servers, many of which are hosted on notorious bulletproof hosting providers including Limenet, Aeza, and Railnet. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Analysis of server configurations revealed consistent patterns across multiple threat actors, suggesting either shared tooling or potential collaboration among different ransomware groups. The infrastructure clustering analysis points to Eye Pyramid becoming an increasingly standardized component in the cybercriminal ecosystem, with its Python-based flexibility allowing for rapid adaptation to evade detection mechanisms. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cybersecurity experts have identified a sophisticated hacking tool called “Eye Pyramid” being actively deployed in malicious campaigns since mid-January 2025. The Eye Pyramid tool functions as a versatile backdoor, allowing attackers to maintain persistence within compromised networks while deploying additional offensive tools. A breakthrough in understanding Eye Pyramid’s operational structure came when Intrinsec’s team discovered a specific JSON file serving as the default error response for Eye Pyramid servers. These providers are known for their lax policies regarding illicit activities, providing threat actors with resilient infrastructure resistant to takedown efforts. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Further investigation revealed Eye Pyramid’s deployment in conjunction with established malware families, including Cobalt Strike, Sliver, and Rhadamanthys.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 02 May 2025 09:55:15 +0000