iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Kaspersky assessed Travle, also called PYLOT, as a possible successor to NetTraveler—not a confirmed continuation of the same malware or proof of common authorship. Its 2017 analysis describes a backdoor used in spear-phishing campaigns and outlines how it gathered system information, communicated with command servers, and carried out tasks on infected machines.
What is Travle (also called PYLOT)?
Travle is the name Kaspersky used for a backdoor its researchers said they had detected in attacks since at least 2015. A related sample is discussed as PYLOT in connection with earlier reporting by Palo Alto Networks. The names refer to related reporting about the backdoor, not necessarily to separate malware families.
The name Travle came from an early sample string, “Travle Path Failed!” Later releases corrected the spelling to “Travel.” Kaspersky’s researchers described the family as a possible NetTraveler successor, writing: “We believe that Travle could be a successor to the NetTraveler family.” That is a qualified assessment, not a settled finding.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How was Travle delivered, and whom did it target?
Kaspersky’s report describes malicious documents used in spear-phishing. Document filenames suggested Russian-speaking targets; a contemporaneous account characterized reported victims as primarily government, military, and high-tech research entities in the Commonwealth of Independent States (CIS) region. These details describe the campaigns covered at the time, not a current victim profile.
#1 Best Overall
What did the analyzed sample do?
The technical account describes a DLL sample that exported a single function named MSOProtect. Its listed compile timestamp was 2016-10-14 06:21:07. That timestamp belongs to the analyzed sample; it does not establish when Travle was first deployed, and it should not be generalized to every version.
According to the Kaspersky analysis and the contemporaneous SecurityWeek summary, reported capabilities included:
- Collecting host details and sending initial information by HTTP POST. The summary lists a user identifier based on the computer name and IP address, computer name, keyboard layout, operating-system version, IP addresses, and MAC address.
- Communicating with command-and-control servers using encrypted communications.
- Scanning and manipulating files, executing commands or downloaded payloads, and loading DLLs in response to tasking.
These are capabilities described in published analysis, not behaviors independently tested here. Kaspersky also documented initialization of temporary-directory paths for a drop zone and plugin storage, along with a configuration-file path. Settings were encrypted and could be read from a resource if a configuration file was unavailable; the report does not establish that every version worked identically.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why did Kaspersky connect Travle to NetTraveler?
The proposed relationship rests on technical and infrastructure overlaps, rather than a demonstrated chain of development or a confirmed operator identity. Kaspersky reported that Travle command-and-control domains often overlapped with Enfal’s. It also noted that some Enfal samples used an encryption method for command-and-control URL strings previously used in NetTraveler, and connected this document-encryption technique with Microcin.
Rank #3
Those overlaps led Kaspersky to assess that the families were related and to describe a Chinese-speaking origin as likely. They do not prove that one group authored all the families, that Travle directly evolved from NetTraveler, or that the same operators controlled them. The article’s central qualification is therefore important: “possible successor” is more accurate than “confirmed successor.”
What does the timeline establish?
Kaspersky said it had detected attacks employing Travle since at least 2015. The analyzed DLL’s compile timestamp is later, in October 2016. These facts are compatible: a sample’s compile time is not the same as a family’s first appearance or first deployment.
For historical context, MITRE ATT&CK’s NetTraveler software entry describes samples with timestamps reaching back to 2005 and says the largest number of observed samples were created between 2010 and 2013. That context does not establish a direct lineage from NetTraveler to Travle.
Free tools Windows power users keep installed
One-click scans. No signup required.
What is known about Travle today?
The cited technical account is from 2017. It does not establish whether Travle/PYLOT remains active, whether historical infrastructure indicators still resolve or remain useful, or what current detection and cleanup procedures apply. It also does not validate a consumer utility as a Travle-specific remedy.
Best Value
If an organization suspects an active targeted intrusion, it should follow its incident-response process and involve qualified security staff. The historical analysis is not a current incident-response or removal guide.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
