Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors

Summary: Unit 42 researchers linked an ongoing campaign that uploaded poisoned Python packages to PyPI to the North Korean threat actor Gleaming Pisces, with the packages decoding and executing code that ran bash commands to download a Linux RAT they named PondRAT. The researchers assess PondRAT is a lighter version of POOLRAT, sharing function names like FConnectProxy and AcceptRequest and the same encryption key as the macOS RAT kupayupdate_stage2 that CISA reported in a 2021 AppleJeus wave, and they also identified new Linux variants of POOLRAT.

What's compelling: Gleaming Pisces, active since at least 2018 and tied to North Korea's Reconnaissance General Bureau, aimed to reach supply chain vendors through developers' endpoints and then the vendors' customers, so a single malicious package install can compromise an entire network.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related