pirpi

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.pirpi

Threat Analysis

pirpi is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/

→https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong

→https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf

→https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html

→https://www.secureworks.com/research/threat-profiles/bronze-mayfair

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

win.pirpiSHOTPUTpirpiCookieCutter

External Intelligence

Malpedia: win.pirpi

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search pirpi