North Korea-linked threat actor Slow Pisces has been caught targeting crypto developers in a malicious campaign that’s parading data-stealing malware impersonating coding assignments. Slow Pisces, known by several other names, was allegedly behind the Bybit hack, which stole $1.5 billion from the Japanese crypto exchange.
The campaign operated as a usual recruitment scam and was flagged by Palo Alto Networks Unit 42. According to their report, the campaign lures in crypto developers by posing as potential employers on LinkedIn. Under the guise of assignments to test their skills, they send a compromised project to the developer, infecting their systems with malware dubbed RN Loader and RN Stealer.
First, a malicious PDF with a job description is sent to potential targets. If the targets apply to the job, the threat actors provide a coding challenge, including several tasks in a question sheet. These sheets include several generic software development tasks and a project-based coding challenge.
The project is further linked to a GitHub repository. Slow Pisces has multiple similar GitHub repositories with code taken from open-source projects, including applications for viewing and analysing:
- Stock market data
- Statistics from European soccer leagues
- Weather data
- Crypto prices
Depending on whether the target has applied for a front-end or back-end role, the programming language used in the repositories can also change between Python and JavaScript. Researchers found a couple of Java-based repositories in the mix as well, impersonating a crypto program called jCoin. Analysts at both GitHub and LinkedIn have been tipped off about the campaign, and relevant accounts and repositories have already been taken down.
The main malware in question is RN Stealer, a macOS infostealer capable of extracting sensitive information. This information includes the victims’ home directory, iCloud keychain credentials, stored SSH keys, and configuration files for AWS, Kubernetes, and Google Cloud.
The cybercrime group differentiates itself from others by heavily implementing operational security. Each of its payload delivery steps is guarded and exists in memory only. The final payload is only deployed when necessary, avoiding detections and making analysis harder.
In the News: Meta resumes training AI models on EU user data
