Date: 09/19/2024
Severity: Medium
Summary
The "Gleaming Pisces Poisoned Python Packages" campaign involves attackers distributing malicious Python packages that deliver a backdoor called PondRAT to Linux and macOS systems. These packages are designed to look legitimate, tricking users into downloading them. Once installed, PondRAT allows attackers to remotely control the infected systems, compromising security and potentially stealing sensitive information. This highlights the importance of verifying software sources and being cautious with package installations.
Indicators of Compromise (IOC) List
URL/Domain | rebelthumb.net jdkgradle.com |
Hash |
5c907b722c53a5be256dc5f96b755bc9e0b032cc30973a52d984d4174bace456
f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703
973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c
0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7
cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86
bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b
bce1eb513aaac344b5b8f7a9ba9c9e36fc89926d327ee5cc095fb4a895a12f80
3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
URL/Domain | userdomainname like "rebelthumb.net" or url like "rebelthumb.net" or userdomainname like "jdkgradle.com" or url like "jdkgradle.com" |
Hash |
sha256hash IN ("5c907b722c53a5be256dc5f96b755bc9e0b032cc30973a52d984d4174bace456","f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703","973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c","0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7","cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86","bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b","bce1eb513aaac344b5b8f7a9ba9c9e36fc89926d327ee5cc095fb4a895a12f80","3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e") |
Reference:
https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/