SimpleTea (ELF)Malware
- PondRAT
- simplextea
SimpleTea for Linux is an HTTP(S) RAT. It was discovered in Q1 2023 as an instance of the Lazarus group's Operation DreamJob campaign for Linux. It was a payload downloaded in an execution chain which started with an HSBC-themed job offer lure. It shared the same C&C server as payloads from the 3CX incident around the same time.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1056.001Keylogging
“InvisibleFerret supports functions such as remote control, data exfiltration, browser stealing capabilities, and keylogging.”
- T1059.009Cloud API
“api.camdriverhub.cloud api.camdrivers.cloud”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Lazarus ClickFake Interview Campaign: ClickFix Malware“…are and tools to achieve its objectives, leveraging wiper (Sharpknot), spyware (Manuscrypt), ransomware (VHD), trojanised applications (PondRAT), and exploiting open-source and zero-day vulnerabilities.”
Indicators in its reports
named in the reports above- hxxps://www.archblock[.]comin 1 report
- www.archblock[.]comin 1 report
- all[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiadrivers-kp9s.updatein 1 report
- api.smartdriverfix[.]cloudin 1 report
- scenarios[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/coremedia-kp9s.shin 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiawins-updatein 1 report
- driverpackx[.]appin 1 report
- process.parent[.]pidin 1 report
- vid-crypto-assess[.]comin 1 report
- assessiohq[.]comin 1 report
- blockassess[.]comin 1 report
- blockchainjobassessment[.]comin 1 report
- blockchainjobhub[.]comin 1 report
- candidateinsightinfo[.]comin 1 report
- coinbase-walet[.]bizin 1 report
- coinbase-walet[.]mein 1 report
- competency-core[.]comin 1 report
- devchallengehq[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.