Loading malware…
POOLRAT is a cross-platform backdoor associated with North Korea’s Lazarus Group, with variants documented for macOS, Linux, and Windows. It provides remote command execution and uses anti-forensic file-deletion routines that overwrite and rename files before removing them. Its Linux and macOS variants share closely matching configuration-loading structures, strings, and command-handling mechanisms.
POOLRAT was deployed on 3CX’s macOS build server during the intrusion associated with the 2023 3CX software supply-chain compromise, using Launch Daemons for persistence. It was also observed alongside ThemeForestRAT in a 2020 incident involving a financially motivated Lazarus subgroup targeting financial and cryptocurrency organizations. Linux variants have additionally been distributed through malicious Python packages hosted on PyPI, exposing developer environments to compromise.
POOLRAT is closely related to PondRAT, which has been assessed as a lighter successor. The families share naming conventions, XOR-key material, shell-command formatting, bot-identifier generation concepts, command-response construction, and secure-deletion behavior.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“In the incident response case from 2020 we encountered POOLRAT in combination with ThemeForestRAT.”
One notable exception is the file deletion command, which overwrites each file with constant bytes seven times before renaming and deleting it, a secure deletion pattern consistent with PondRAT and POOLRAT, two malware families previously associated with this actor.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
"The attackers behind this campaign uploaded several poisoned Python packages to PyPI..." ... "Successful installation of malicious third-party packages can result in malware infection that compromises an entire network."
"SentinelOne began to see a spike in behavioral detections of the 3CXDesktopApp... Behavioral detections prevented these trojanized installers from running... The compromise includes a code signing certificate used to sign the trojanized binaries."
"Operation Dream Job, wherein prospective targets are lured with enticing job offers in an attempt to trick them into downloading malware."
"3CX’s macOS build server was compromised with POOLRAT backdoor using Launch Daemons as a persistence mechanism."
"3CX’s macOS build server was compromised with POOLRAT backdoor using Launch Daemons as a persistence mechanism."
Before contacting its command-and-control server, it removes security hooks placed by endpoint protection products and disables Windows event tracing, allowing the malware to operate with little or no visibility to defenders.
RemotePE also implements secure file deletion functionality by repeatedly overwriting files seven times prior to deletion, behavior previously associated with Lazarus-linked malware families such as PondRAT and POOLRAT.
"...runs the Linux and macOS versions of the RAT malware after retrieving them from a remote server." ... "the mechanism that handles commands from the [command-and-control server] is nearly identical."
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.