Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Slow Pisces, a North Korean state-sponsored threat group, is targeting cryptocurrency developers through LinkedIn with malicious coding challenges. The group impersonates recruiters and sends malware disguised as project tasks, infecting systems with RN Loader and RN Stealer. Their campaign uses GitHub repositories containing adapted open-source projects in Python and JavaScript. The malware employs YAML deserialization and EJS rendering to execute arbitrary code from command-and-control servers. Slow Pisces has reportedly stolen over $1 billion from the cryptocurrency sector in 2023, using various methods including fake trading applications and supply chain compromises. The group's operational security is noteworthy, with payloads existing only in memory and deployed selectively.

Slow Pisces is a North Korean state-sponsored threat actor that has developed a sophisticated campaign targeting cryptocurrency developers, primarily via LinkedIn. The group impersonates recruiters and sends malicious coding challenges disguised as legitimate project tasks. These challenges contain malware payloads, specifically RN Loader and RN Stealer, which are designed to infect the victim's system stealthily. The malware is delivered through GitHub repositories that leverage adapted open-source projects written in Python and JavaScript. A notable technical aspect of the malware is its use of YAML deserialization and EJS (Embedded JavaScript) rendering techniques to execute arbitrary code fetched from command-and-control (C2) servers. This approach enables dynamic and flexible execution of malicious code, increasing the difficulty of detection and analysis. Slow Pisces has demonstrated operational security by ensuring that payloads exist only in memory and are deployed selectively, reducing forensic footprints and complicating incident response efforts. The group has reportedly stolen over $1 billion from the cryptocurrency sector in 2023 using multiple attack vectors, including fake trading applications and supply chain compromises. The campaign's focus on cryptocurrency developers suggests a targeted approach to compromise individuals with access to valuable digital assets or development environments that could be leveraged for further attacks.

Detailed information about Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware. Get real-time updates, technical 

Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'yaml deserialization'

Filter Threats

Threats Tagged 'yaml deserialization'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility