Malware
SNOWBASIN
According to Mandiant, this malware acts as a persistent backdoor that operates as a local HTTP server (typically listening on port 8000).
SNOWBASIN is a Python malware family operated by UNC6692.
Background
Mandiant reports that this malware serves as a persistent backdoor running as a local HTTP server, usually bound to port 8000. It supports remote command execution through cmd.exe or powershell.exe, screenshot capture, and the staging of data for exfiltration, making it the stage where active reconnaissance and mission objectives are carried out. Attacker commands such as whoami or net user travel through the SNOWGLAZE tunnel, are picked up by the SNOWBELT extension, and are then proxied to the local SNOWBASIN server via HTTP POST requests. SNOWBASIN runs the commands and sends the output back to the attacker along the same path.
Source: Malpedia (Fraunhofer FKIE).