Once downloaded, these packages execute a second-stage payload that fetches the malware from a remote server, targeting Linux and macOS systems.
The threat actor behind this campaign has been identified as Gleaming Pisces, also known as Citrine Sleet, Labyrinth Chollima, Nickel Academy, and UNC4736—a sub-cluster within the Lazarus Group. They are notorious for distributing the AppleJeus malware, a sophisticated tool used in cryptocurrency theft and espionage operations.
Malware Capabilities and Objectives
PondRAT is described as a lighter version of POOLRAT, designed with enhanced capabilities for both Linux and macOS platforms. It includes functionality to upload and download files, execute arbitrary commands, and pause operations based on preconfigured time intervals. The malware’s core components resemble those of POOLRAT, particularly in how it processes commands from its command-and-control (C2) server.
The Linux and macOS variants of POOLRAT share an almost identical structure in their configuration loading mechanisms, with method names and functionality being strikingly similar across both platforms. This continuity across different operating systems suggests that Gleaming Pisces has been refining its toolkit to enhance its reach and effectiveness.
Supply Chain Compromise and Developer Targeting
The strategic targeting of software developers through poisoned Python packages is part of a broader goal to gain access to supply chain vendors. By compromising developers’ endpoints, the attackers can infiltrate vendor networks and ultimately reach the customers of these vendors—similar to the infamous 3CX incident.
This attack method poses significant risks, as successful installation of malicious packages in development environments can lead to widespread compromise within an organization’s network. Once inside, the malware can provide attackers with remote access, enabling data theft, espionage, and further propagation through the network.