RN Stealer
RN Stealer is a Python-based infostealer tracked as RN Stealer and associated with the North Korean threat group Slow Pisces, also known as Jade Sleet, TraderTraitor, and PUKCHONG. It was observed in a campaign targeting cryptocurrency developers through fake recruiting and malicious coding challenges hosted on GitHub. In the Python infection chain, trojanized repositories used unsafe PyYAML deserialization to execute an in-memory payload sequence that deployed RN Loader and then RN Stealer, with malicious content selectively delivered only to validated victims while non-targets received benign responses.
RN Stealer was recovered as a payload delivered through RN Loader. It generates a random victim ID that is used as a cookie in communications with its command-and-control server, requests an XOR key from the server for encrypting exfiltrated data, and uses Base64-encoded tokens R0, R64, R128, and R256 to manage communications and exfiltration. The recovered sample was taken from a macOS system.
Its collection focus includes sensitive developer and cloud-related data from macOS hosts, including the login.keychain-db file, stored SSH keys, installed applications, home directory contents, and configuration files for AWS, Kubernetes, and Google Cloud. Reporting also describes RN Stealer, together with RN Loader, as part of TraderTraitor’s malware arsenal used to harvest SSH keys, saved credentials, and cloud service configurations from compromised developer workstations. The activity is tied to financially motivated DPRK operations focused primarily on the cryptocurrency sector.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
However, we recovered a Python-based infostealer delivered by option 2, and we track this malware as RN Stealer. RN Stealer first generates a random victim ID, subsequently used as a cookie in all communications to the C2 server. It then requests an XOR key from the server for encrypting exfiltrated data.
However, we recovered a Python-based infostealer delivered by option 2, and we track this malware as RN Stealer. RN Stealer first generates a random victim ID, subsequently used as a cookie in all communications to the C2 server. It then requests an XOR key from the server for encrypting exfiltrated data.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
“...posing as potential employers and sending malware disguised as coding challenges... require developers to run a compromised project...” ; “...ran the script without inspecting its contents... hidden malware... credentials... stolen...”
Slow Pisces began by impersonating recruiters on LinkedIn and engaging with potential targets, sending them a benign PDF with a job description... attackers presented them with a coding challenge... which links to a GitHub repository.
Execution
1 technique
Execution
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Discovery
2 techniques
Discovery
Command and Control
3 techniques
Command and Control
Communication with the C2 server occurs over HTTPS, using Base64-encoded tokens to identify request and response types... It then requests an XOR key from the server for encrypting exfiltrated data.
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named stealer referenced in TraderTraitor-related reporting.
RN Stealer is a Python-based information stealer used by TraderTraitor to harvest SSH keys, saved credentials, and cloud service configurations from compromised developer workstations, facilitating further compromise of cloud assets.
Stealer malware deployed by North Korean threat actors to exfiltrate sensitive data from infected cryptocurrency developers' systems.
Information-stealing malware used against cryptocurrency developers via a coding-challenge lure.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.