JPCERT/CC Eyes blog: Practical Challenges of Attribution in the Case of Lazarus's Subgroup
Gleaming Pisces (Citrine Sleet) PyPI campaign with PondRAT · 2024
Similar to Moonstone Sleet, this subgroup performs initial compromise using PyPI.
Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors
- Date (as written)
- 2024-09-18T14:00:59
- Year
- 2024
Source entries (3)
Hackmageddon cyber attacks timelines (Paolo Passeri)
Multiple organizations · 18/09/2024
Researchers at Palo Alto Networks reveal that threat actors with ties to North Korea have been observed using poisoned Python packages as a way to deliver a new malware called PondRAT as part of an ongoing campaign. [Date Occurred: -; Date Discovered: -]
Palo Alto Networks Unit 42
Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors · 2024-09-18T14:00:59
We track a campaign by Gleaming Pisces (Citrine Sleet) delivering Linux or macOS backdoors via Python packages, aiming to infiltrate supply chain vendors.