Operation Navy Ghost: Backdoored PyPI Packages Exploit Bots

Technical Analysis of the Backdoor and Attack Chain

A deep dive into the code structure reveals a highly calculated execution flow. The key to the backdoor is a hidden script named secret.py, placed within the helpers directory of the modified Pyrogram structure. The entry point of this backdoor is executed through one of two distinct triggering mechanisms, depending on the specific package variation installed:

• Import-Time Trigger: In packages like vlifegram, the backdoor execution is triggered the moment the package is imported into any Python script. This is achieved by embedding an import statement for secret.py directly inside the helpers/__init__.py initialization file.

• Startup-Time Trigger: In other variants, such as kelragram or pyrogram-navy, the backdoor is wired into the client startup lifecycle. It executes when the bot's start() routine is invoked, allowing the backdoor to piggyback on the legitimate client connection process.

The Gating Logic and Self-Exclusion Mechanisms

To ensure that the campaign remains stealthy and only targets high-value targets, the backdoor contains two critical gating conditions before executing its primary payloads:

First, it performs a contextual bot-exclusive check using the statement if self.me.is_bot. If the running instance is a standard user account (a userbot), the execution stops. This focuses the campaign strictly on production Telegram bots, which are typically hosted on cloud servers, virtual machines, or local enterprise databases, where access to secrets and production databases is common.

Second, the backdoor contains a self-exclusion guard that checks the bot's numeric account ID against a hardcoded array of integer IDs labeled OWNERS. If the bot's ID is found in this list, the execution immediately terminates. This ensures that when the attacker runs the backdoor code on their own testing environments, the payload does not trigger, preventing self-infection and reducing the risk of accidental exposure during development.

Command and Control (C2) and Remote Execution

Once the backdoor is successfully initialized, it registers stealthy event handlers that listen for specific messages from authorized accounts. These message handlers bypass the normal bot routing logic, listening silently for commands sent by accounts that match the hardcoded OWNERS list. The primary commands identified in the backdoor include:

• Python Execution Command: Triggered via /asu or /wann, this command accepts a block of Python code as a string, compiles it, and executes it using the exec(compile()) statement. This provides the attacker with full control over the running Python process, allowing them to extract active environment variables, dump memory states, and hijack session data.

• Host Shell Execution Command: Triggered via /asi or /wann2, this command executes arbitrary operating system commands by spawning a subprocess through /bin/bash -c. Because the command runs with the same privileges as the parent Python bot process, the attacker can traverse the file system, read sensitive system files like /etc/passwd, or download persistent binaries.

Native Data Exfiltration Channels

The backdoor relies entirely on Telegram's official MTProto API to communicate with the command and control nodes. This represents a classic "living off the API" technique, making network-level detection incredibly difficult. All commands and exfiltrated data are packaged inside standard, encrypted MTProto traffic, easily passing through corporate firewall systems and network security monitors. If the output of a shell command exceeds the maximum Telegram message limit of 4,096 bytes, the backdoor automatically saves the data into a temporary text file and uploads it to the attacker's channel using the native reply_document method.

Enterprise Impact and Risks to GCC Infrastructure

The reliance on automated Telegram bots for notifications, customer support, and system alerts is highly prevalent across GCC enterprises, particularly in retail, financial technology, and tech startups. Because these bots require continuous connectivity to internal networks and databases to serve functional queries, a compromise of the underlying bot server is equivalent to an internal network breach.

With remote shell access, threat actors can conduct lateral movement, harvest cloud provider metadata tokens, compromise Kubernetes pods, and retrieve active database connection strings. This can lead to substantial database leaks and exposure of customer data, resulting in both financial losses and severe regulatory non-compliance issues under regional data protection laws.

If you suspect that your developer environments or Telegram bot configurations have been compromised, you should immediately analyze whether any credentials or server tokens have leaked. Use FemtoSec's Dark Web Scanner to check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.

Enterprises must continuously evaluate all external-facing integrations, including third-party APIs and automated bots, using comprehensive Attack Surface Management to detect exposed resources before threat actors exploit them.

Detection and Threat Hunting Strategies

Securing the enterprise against Operation Navy Ghost requires proactive threat hunting inside both active environments and development repositories. Security operations teams should execute systematic audits of all Python environments running on production or staging environments.

1. Identifying Rogue Packages via Pip

Run the following query on all host servers to check if any of the malicious packages have been installed via the Python package manager:

pip show vlifegram vlife-gram kelragram pyrogram-navy pyrogram-styled sepgram pyrogram-kelra pyrogram-zeeb

Additionally, search historical pip installation logs to find traces of temporary or removed installations:

cat ~/.local/share/pip/pip.log 2>/dev/null | grep -E "vlifegram|vlife-gram|kelragram|pyrogram-navy|pyrogram-styled|sepgram|pyrogram-kelra|pyrogram-zeeb"

2. Hunting for the Backdoor Artifact

You can execute a targeted system-wide search to locate any instances of the unauthorized secret.py file buried inside the Pyrogram library folder structure:

find / -path "*/pyrogram/helpers/secret.py" 2>/dev/null

3. Implementing YARA Detection Rules

Deploying static signature rules on repositories and container images can prevent these packages from reaching production. The following YARA rule is designed to flag the specific combination of client hijacking, self-exclusion, and remote execution logic used by Operation Navy Ghost:

rule OperationNavyGhost_BehaviorPattern {
    meta:
        description = "Detects pyrogram backdoor pattern"
        author = "Checkmarx Security Research"
        severity = "CRITICAL"
        reference = "Operation Navy Ghost"
    strings:
        $handler_msg = "MessageHandler" ascii
        $handler_cq = "CallbackQueryHandler" ascii
        $filter_cmd = "filters.command" ascii
        $filter_user = "filters.user" ascii
        $add_handler = "add_handler" ascii
        $exec_compile = "exec(compile(" ascii
        $subprocess = "subprocess.run" ascii
        $bash_shell = "/bin/bash" ascii
        $reply_doc = "reply_document" ascii
        $self_exclude = /if\s+\w+\.me\.id\s+in\s+\w+/ ascii
        $owner_list = /\w+\s*=\s*\[\s*\d{7,10}(\s*,\s*\d{7,10})+\s*\]/ ascii
    condition:
        $add_handler and $handler_msg and $filter_cmd and $filter_user and $exec_compile and $subprocess and $reply_doc and ($self_exclude or $owner_list)
}

Recommended Incident Response and Containment Steps

If an active compromise is confirmed within your infrastructure, immediate containment is required to prevent further database harvesting or lateral movement. Follow these steps to secure your environment:

• Process Termination: Locate and kill the running process ID of the compromised Telegram bot immediately. This halts active shell sessions and terminates the live C2 pipeline.

• Uninstall and Purge: Force-uninstall the malicious library and clear the pip package cache to prevent accidental reinstallations:

  pip uninstall -y <malicious_package_name> && pip cache purge

• Revoke Bot Token: Message the official Telegram BotFather account (@BotFather) and select the compromised bot. Use the /revoke command to instantly invalidate the existing API token and generate a new one. This breaks the primary communication route of the threat actor.

• Credentials Rotation: Assume all credentials, access keys, database passwords, and SSH keys accessible on the compromised host have been exfiltrated. Rotate these keys immediately across all cloud and local environments.

• Persistence Audit: Inspect local cron jobs, active systemd services, and shell history logs to ensure that the threat actor did not install secondary persistent backdoors, such as rogue cron tasks, before the bot process was terminated.