Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware

Summary: Unit 42 reports that Slow Pisces, a North Korean state-sponsored group, posed as recruiters on LinkedIn and sent cryptocurrency developers coding challenges built from GitHub repositories containing malware it named RN Loader and RN Stealer. The group stole over $1 billion USD from the cryptocurrency sector in 2023, and the FBI attributed the December 2024 theft of $308 million from a Japan-based cryptocurrency company to Slow Pisces.

Bottom line: The malicious code sits in repositories adapted from legitimate open-source projects, and the command-and-control server returns valid application data to anyone it has not validated, so a developer running the challenge sees a working project while the payload goes only to the intended target.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related