Python Screenshotter Targets Tatar-Language Users

Cyble Research and Intelligence Labs observed a targeted malware campaign using a RAR-distributed PyInstaller executable masquerading as an image/video for Tatar Republic Day; the loader displays a benign image while executing PowerShell to download a ZIP from Dropbox, install a persistent PyInstaller binary (pyisgit.exe) via scheduled tasks, and run a PowerShell screenshotter (sc_new.ps1) that captures images in loops and exfiltrates them to a remote FTP server. The report includes full kill-chain details, file hashes, URLs/FTP server, and mitigation recommendations.