This threat involves a typosquatted PyPI package named 'tennacity' in versions 1.0.0, 1.2.0, and 1.2.2 that installs a Mythic/Poseidon command and control (C2) beacon. The malicious code ensures persistence on the infected host and communicates with a remote C2 server at wegoexchange[.]site for additional commands. The package also includes sandbox detection mechanisms to evade analysis. The campaign is classified as malicious with activities including malware installation, remote executable download and execution, and persistence mechanisms.

The malicious package installs a persistent C2 beacon that can receive and execute commands from a remote attacker, potentially leading to unauthorized control of the infected system. The presence of sandbox detection indicates attempts to evade security analysis, increasing the risk of undetected compromise. This can result in data theft, system manipulation, or further malware deployment.

No official patch or remediation is available as this is a malicious typosquatting package rather than a vulnerability in legitimate software. The best mitigation is to avoid installing packages from untrusted or suspicious sources and verify package authenticity before installation. Security teams should monitor for and remove any instances of these specific versions (=1.0.0, =1.2.0, =1.2.2) of the 'tennacity' package if found in their environments.