VIPERTUNNEL Hijacks Python for Stealthy Ransomware Access

InfoGuard's analysis uncovers VIPERTUNNEL, a modular Python backdoor used alongside DragonForce ransomware that persists via C:\ProgramData\cp49s\Lib\sitecustomize.py, uses Base85 encoding and control-flow flattening to evade detection, and establishes a SOCKS5 tunnel to hardcoded C2 over port 443; linked actors include UNC2165 and EvilCorp, and related ShadowCoil samples suggest the obfuscation framework may be extended to Linux.