North Korean Hackers Use Poisoned Python Packages to Distribute PondRAT Malware

 

Introduction

In recent cybersecurity developments, threat actors associated with North Korea have been found using malicious Python packages to distribute a new malware called PondRAT. This discovery is part of a broader campaign linked to the Lazarus Group, a notorious hacking group known for its cyber espionage activities. The malware has raised concerns within the cybersecurity community, particularly due to its distribution methods and ties to past high-profile attacks.

Overview of PondRAT and POOLRAT Connection

PondRAT, as recently uncovered by Palo Alto Networks’ Unit 42, is described as a stripped-down version of POOLRAT (also known as SIMPLESEA), a known macOS backdoor. POOLRAT has been previously attributed to the Lazarus Group and was involved in a significant supply chain attack on the 3CX platform. The emergence of PondRAT marks a continuation of these malicious efforts, with the malware being deployed through poisoned Python packages.

Operation Dream Job Campaign

One of the tactics employed by North Korean hackers in this campaign is known as Operation Dream Job. In this operation, attackers lure targets by presenting fake job offers, tricking them into downloading malicious software. The poisoned Python packages, uploaded to PyPI, a popular Python package repository, served as the vehicle for these attacks. These packages included:

• real-ids (893 downloads)
• coloredtxt (381 downloads)
• beautifultext (736 downloads)
• minisound (416 downloads)

Once downloaded, these packages are designed to execute an encoded payload that downloads and installs the PondRAT malware on developers' systems, primarily targeting macOS and Linux platforms.

Ties to the Lazarus Group and Other Threat Actors

The adversaries behind these attacks, linked with moderate confidence to a threat group called Gleaming Pisces, are also tracked under various names, including Citrine Sleet, Labyrinth Chollima, Nickel Academy, and UNC4736. These groups are known to operate as part of the Lazarus Group, which has a history of distributing sophisticated malware such as AppleJeus. The ultimate aim of these campaigns appears to be gaining access to supply chain vendors by compromising developers’ endpoints, thereby extending the attack to the vendors’ customers.

Technical Analysis of PondRAT

Further analysis of PondRAT has revealed close similarities with both POOLRAT and AppleJeus, particularly in their structure and functionality. The malware variants for Linux and macOS platforms share an identical framework for loading configurations, utilizing similar methods and commands. PondRAT itself offers capabilities that include uploading and downloading files, pausing operations, and executing arbitrary commands on compromised systems.

This malware’s continued evolution, particularly through the addition of new Linux variants, demonstrates that the attackers are actively enhancing their tools to increase their effectiveness across multiple platforms.

The Risk to Organizations

The use of legitimate-looking Python packages to spread malware poses a significant risk to organizations, especially those relying on open-source software. The installation of these malicious third-party packages can result in malware infections that compromise entire networks. This threat has become more alarming in the context of the wider trend of North Korean hackers attempting to infiltrate companies by submitting fake resumes and applications, as reported by cybersecurity firm KnowBe4.

This tactic has already affected several organizations, with North Korean operatives successfully securing employment or flooding companies with fraudulent job applications. Known as "Famous Chollima," this state-sponsored operation represents a growing risk for businesses, especially those with remote workers.

Conclusion

The discovery of PondRAT and its use in the ongoing campaign underscores the growing sophistication of North Korean threat actors and their ability to exploit open-source repositories to distribute malware. Organizations must remain vigilant, particularly when using third-party software, as the potential for supply chain compromises continues to rise. Additionally, the infiltration of companies through fake job applications highlights the evolving nature of cyber threats in today’s increasingly digital world.