Loading malware…
PondRAT is a cross-platform remote access trojan associated with North Korean Lazarus Group activity, with variants for Windows, Linux, and macOS. It provides remote file upload and download, file reading and writing, process execution, arbitrary shell-command execution, and configurable pauses in operation. Analyzed Windows variants also support loading portable executable payloads into memory and executing shellcode. PondRAT communicates with hardcoded command-and-control servers over HTTP or HTTPS, using XOR encryption and Base64 encoding for its messages. Windows variants securely erase temporary command-output files through overwriting and repeated renaming before deletion.
PondRAT has been distributed through malicious Python packages uploaded to PyPI. Installing these packages triggers an encoded intermediate stage that retrieves and executes Linux or macOS payloads. Its distribution has been associated with job-offer lures targeting developers. PondRAT has also been deployed alongside ThemeForestRAT in intrusions against financial and cryptocurrency organizations, serving as an initial-access implant for deploying additional malware. It shares substantial code and behavioral similarities with POOLRAT. In an observed intrusion, operators used PondRAT and ThemeForestRAT for approximately three months before replacing them with the more advanced RemotePE toolset.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“PondRAT was the initial access payload used to deploy other types of malware, including ThemeForestRAT.”
In one investigation, we observed that the actor had replaced ThemeForestRAT and PondRAT with a more sophisticated memory-only toolset.
Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE
5 distinct techniques documented for this family, organized by ATT&CK tactic.
"The attackers behind this campaign uploaded several poisoned Python packages to PyPI..." ... "Successful installation of malicious third-party packages can result in malware infection that compromises an entire network."
"Operation Dream Job, wherein prospective targets are lured with enticing job offers in an attempt to trick them into downloading malware."
Before contacting its command-and-control server, it removes security hooks placed by endpoint protection products and disables Windows event tracing, allowing the malware to operate with little or no visibility to defenders.
RemotePE also implements secure file deletion functionality by repeatedly overwriting files seven times prior to deletion, behavior previously associated with Lazarus-linked malware families such as PondRAT and POOLRAT.
"...runs the Linux and macOS versions of the RAT malware after retrieving them from a remote server." ... "the mechanism that handles commands from the [command-and-control server] is nearly identical."
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.