North Korean-affiliated threat actors have been observed deploying malicious Python packages as part of a cyber campaign that delivers a new malware strain called PondRAT, according to Palo Alto Networks' Unit 42.
This campaign has been linked to Operation Dream Job, a persistent cyber attack scheme that lures victims with fake job offers, tricking them into downloading malware. PondRAT is a lighter version of POOLRAT (also known as SIMPLESEA), a macOS backdoor previously attributed to the notorious Lazarus Group. POOLRAT was also used in attacks related to the 3CX supply chain compromise last year.
In these recent attacks, the adversaries uploaded poisoned Python packages to the PyPI repository (Python Package Index), a popular source of open-source Python libraries. The infected packages included real-ids, coloredtxt, beautifultext, and minisound, which were downloaded hundreds of times before being removed.
The infection chain is straightforward: once the package is downloaded and installed, it retrieves a next-stage payload from a remote server, which then runs Linux or macOS versions of the Remote Access Trojan (RAT) malware.
Palo Alto Networks' researcher Yoav Zemah said the activity is linked with moderate confidence to a threat actor called Gleaming Pisces, who is also known by other names, including Citrine Sleet, Labyrinth Chollima, Nickel Academy, and UNC4736. This sub-cluster of the Lazarus Group has been previously associated with distributing the AppleJeus malware.
PondRAT: A Versatile Threat
Further analysis revealed that PondRAT shares similarities with POOLRAT and AppleJeus, and now includes Linux variants, which indicate a growing focus on cross-platform attacks. Both the Linux and macOS versions of POOLRAT use identical functions and method names to load configurations and handle commands from their command-and-control (C2) server.
PondRAT is a more streamlined version of POOLRAT, with capabilities that allow it to:
- Upload and download files
- Pause operations for set time intervals
- Execute arbitrary commands
The deployment of malicious third-party packages presents a major risk to organizations, especially those using open-source software. Installing these poisoned Python packages can lead to malware infections that compromise entire networks.
Broader Implications for Supply Chain Security
Palo Alto Networks also emphasized that these attacks target software developers, with the goal of infiltrating supply chain vendors. By compromising developer endpoints, the attackers can eventually gain access to the vendors' customers, repeating tactics used in previous supply chain compromises.
This campaign follows another alarming trend—North Korean actors using fake resumes and job applications to infiltrate companies. KnowBe4, a security awareness company, recently revealed that more than a dozen companies had unknowingly hired North Korean threat actors or were targeted by fraudulent applications. CrowdStrike tracks this activity under the moniker Famous Chollima, describing it as a "complex, industrial, scaled nation-state operation" that poses serious risks for companies with remote employees.
The rise of PondRAT and similar campaigns highlight the increasing danger posed by supply chain attacks. Organizations should be vigilant when using third-party software and implement stringent security measures to safeguard against these threats.
