LegionLoader _socket.pyd Python C2 from AppData\Roaming Outbound Connection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of Python interpreters from user-writable AppData\Roaming directories initiating external network connections. This behavior is consistent with the execution of LegionLoader malware and its associated _socket.pyd Python C2 module.