What is PondRAT Malware?

A sophisticated cyberattack campaign targeting software developers has been uncovered, with threat actors linked to North Korea utilizing poisoned Python packages to deliver a new malware variant called PondRAT. This campaign, dubbed "Operation Dream Job," leverages enticing job offers to lure unsuspecting developers into downloading the malicious code.

The threat actor behind this campaign, known as Gleaming Pisces, is a sub-cluster within the infamous Lazarus Group, notorious for its involvement in high-profile cyberattacks, including the 3CX supply chain compromise. They are also known for distributing AppleJeus malware and have been observed operating under various aliases, such as Citrine Sleet, Labyrinth Chollima, Nickel Academy, and UNC4736.

The discovered Python packages, now removed from the popular repository PyPI, included:

• real-ids (893 downloads)

• coloredtxt (381 downloads)

• beautifultext (736 downloads)

• minisound (416 downloads)

These packages, once downloaded and installed on developer systems, execute an encoded script that retrieves and runs the Linux and macOS versions of the PondRAT malware from a remote server.

A Leaner, More Dangerous Variant

PondRAT, a slimmed-down version of the previously known POOLRAT (aka SIMPLESEA) macOS backdoor, boasts capabilities to upload and download files, pause operations temporarily, and execute arbitrary commands. Its similarity to both POOLRAT and AppleJeus, along with the emergence of new Linux variants of POOLRAT, suggests the threat actor is constantly refining their toolset to target a wider range of systems.

"The Linux and macOS versions [of POOLRAT] use an identical function structure for loading their configurations, featuring similar method names and functionality," stated Yoav Zemah, a researcher from Palo Alto Networks Unit 42. "Additionally, the method names in both variants are strikingly similar, and the strings are almost identical. Lastly, the mechanism that handles commands from the [command-and-control server] is nearly identical."

A Growing Threat to Software Supply Chains

The weaponization of seemingly legitimate Python packages across multiple operating systems poses a significant threat to software supply chains. Successful installation of these malicious packages can lead to malware infection, compromising entire networks and exposing sensitive data.

The discovery of this campaign highlights the growing trend of threat actors targeting software developers to infiltrate organizations. This tactic has proven successful in the past, as evidenced by the 3CX supply chain compromise.

"The attackers behind this campaign uploaded several poisoned Python packages to PyPI, a popular repository of open-source Python packages," Zemah explained. "This highlights the importance of rigorous security practices and due diligence when using third-party packages."

The Human Element in Cyberattacks

This campaign underscores the importance of recognizing the role of human actors in cyberattacks. The use of social engineering techniques, such as enticing job offers, highlights how threat actors exploit human vulnerabilities to gain access to sensitive systems.

A recent incident involving KnowBe4, a cybersecurity awareness training company, further emphasizes this point. KnowBe4 unknowingly hired a North Korean threat actor as an employee, highlighting the sophistication of these campaigns and the difficulty of discerning genuine job applications from those used for malicious intent.

"More than a dozen companies either hired North Korean employees or had been besieged by a multitude of fake resumes and applications submitted by North Koreans hoping to get a job with their organization," KnowBe4 stated. "It described the activity, tracked by CrowdStrike under the moniker Famous Chollima, as a 'complex, industrial, scaled nation-state operation' and that it poses a 'serious risk for any company with remote-only employees.'"

Combating the Threat

Organizations must proactively mitigate the risks associated with this growing threat. This involves implementing robust security measures, including:

• Strict vetting of third-party packages: Organizations should carefully review the source and reputation of any third-party packages before installing them.

• Employee awareness training: Regular training programs that educate employees about phishing attacks and social engineering techniques are crucial to prevent them from falling victim to these tactics.

• Strong security practices: Organizations should implement strong security measures, such as multi-factor authentication, access controls, and regular security audits, to protect their systems and data.

As the threat landscape continues to evolve, organizations must remain vigilant and adapt their security measures accordingly. The use of poisoned Python packages highlights the importance of vigilance and proactive security practices to protect against sophisticated cyberattacks.