APT / THREAT GROUP

PIEHOP

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Mandiant, PIEHOP is a disruption tool written in Python and packaged with PyInstaller version 2.1+ that has the capability to connect to a user supplied remote MSSQL server for uploading files and issuing remote commands to a RTU.

PIEHOP expects its main function to be called via another Python file, supplying either the argument control=True or upload=True. At a minimum, it requires the following arguments: oik, user, and pwd, and if called with control=True, it must also be supplied with iec104.

Threat Analysis

PIEHOP is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.mandiant.com/resources/blog/cosmicenergy-ot-malware-russian-response

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

PIEHOPwin.piehop

External Intelligence

Malpedia: win.piehop

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PIEHOP