Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors
2024-09-18 • Paloalto Networks •
https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/
Unit 42 links a poisoned PyPI package campaign to Gleaming Pisces, also known as Citrine Sleet, with medium confidence based on code similarities and prior attribution. Malicious packages such as real-ids, coloredtxt, beautifultext, and minisound executed encoded code after installation, ran bash commands, and downloaded Linux backdoors onto developer endpoints. The payload family, named PondRAT, shares function names, encryption keys, and command-handling patterns with POOLRAT, a macOS RAT associated with earlier AppleJeus activity. The campaign appears aimed at compromising developers and software supply chain vendors that could lead to downstream customer access.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| HASH | 973f7939ea03fd2c9663dafc21bb968… | 2024-02-29 | 2025-09-01 |
| DOMAIN | jdkgradle.com | 2024-02-29 | 2025-09-01 |
| HASH | 5e40d106977017b1ed235419b1e59ff… | 2021-02-18 | 2025-09-01 |
| HASH | 3c8dbfcbb4fccbaf924f9a650a04cb4… | 2024-09-09 | 2024-12-27 |
| HASH | cbf4cfa2d3c3fb04fe349161e051a8c… | 2024-09-09 | 2024-12-27 |
| HASH | 0b5db31e47b0dccfdec46e74c0e70c6… | 2024-09-09 | 2024-12-27 |
| HASH | 5c907b722c53a5be256dc5f96b755bc… | 2024-09-09 | 2024-12-27 |
| HASH | bfd74b4a1b413fa785a49ca4a9c0594… | 2024-09-09 | 2024-12-27 |
| HASH | bce1eb513aaac344b5b8f7a9ba9c9e3… | 2024-09-09 | 2024-12-27 |
| HASH | f3b0da965a4050ab00fce727bb31e0f… | 2024-09-09 | 2024-12-27 |
| HASH | 91eaf215be336eae983d069de16630c… | 2021-02-18 | 2024-12-27 |
| DOMAIN | rgedist.com | 2023-04-24 | 2024-09-18 |
| DOMAIN | rebelthumb.net | 2022-12-01 | 2024-09-18 |