Poolrat

POOLRAT is a malicious software (malware) first reported by the Cybersecurity and Infrastructure Security Agency (CISA) in 2021. It primarily targets macOS and Linux systems, functioning as a backdoor to gain unauthorized access. The malware was initially identified as a file named 'prtspool', suspected to be the final payload in an AppleJeus attack. POOLRAT shares numerous characteristics with a known North Korean backdoor, PoolRat, spotted by Mandiant in a 2023 supply chain attack against 3CX. This backdoor is attributed to the North Korea-linked threat actor Gleaming Pisces, also known as Citrine Sleet, who previously distributed the macOS remote administration tool POOLRAT, aka SIMPLESEA. In 2023, the attackers compromised the macOS build server using a POOLRAT backdoor with LaunchDaemons for persistent access during a supply chain attack on 3CX. Analysis of this malware family revealed that the Linux and macOS versions use an identical function structure for loading their configurations, including similar method names and functionality. Another malware variant, PondRAT, has been found to have a command handler with similarities to POOLRAT, leading researchers to label it as a lighter version of POOLRAT. Prevention and detection alerts have been implemented for each type of malware, including POOLRAT and PondRAT. Multiple products in the Palo Alto Networks portfolio leverage Advanced WildFire to provide coverage against both these variants and other threats. Despite the severity of the threat posed by these malwares, it's worth noting that their authors have focused exclusively on macOS and Linux systems, bypassing Windows entirely. This suggests a strategic shift in targeting specific operating system platforms.