Loading malware…
RN Loader is a Python-based malware component used by the North Korean threat cluster commonly tracked as TraderTraitor, Jade Sleet, Slow Pisces, and UNC4899, which operates under the Lazarus umbrella and focuses on financially motivated intrusions against the cryptocurrency ecosystem. It has been observed in campaigns targeting cryptocurrency developers through recruiter-themed social engineering and trojanized coding challenges hosted on GitHub. In documented intrusions, victims were enticed to run compromised Python projects that triggered unsafe YAML deserialization, leading to execution of RN Loader in memory.
RN Loader functions primarily as a loader and command-execution stage. It gathers basic host and operating system information, communicates with command-and-control infrastructure over HTTPS, and enters a command loop to receive follow-on tasks. Observed functionality includes sleeping, executing additional Python code supplied by the operator, loading and running secondary binaries or DLLs, launching additional payload components, and terminating on command. Its execution chain is designed for stealth: the dropped Python file deletes itself after launch so the malware remains effectively memory-resident.
RN Loader has been used to deploy RN Stealer, a follow-on infostealer focused on developer workstations, particularly macOS systems used in cryptocurrency and blockchain environments. Through this relationship, RN Loader has supported theft of SSH keys, saved credentials, keychain data, cloud configuration files, and other sensitive developer artifacts. The broader campaigns associated with RN Loader reflect TraderTraitor’s emphasis on compromising cloud-connected development environments and using stolen credentials or sessions to enable downstream theft from cryptocurrency organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware, identified as RN Loader and RN Stealer, harvested sensitive data including SSH keys, saved credentials, and cloud configurations.
The YAML deserialization payload executes malware we have named RN Loader and RN Stealer based on the C2 token format we observed in RN Stealer. ... This newly created file for RN Loader at ~/Public/__init__.py deletes itself after execution, ensuring that it exists solely in memory. It sends basic information about the victim machine and operating system over HTTPS to the same C2 at en.stockslab[.]org, followed by a command loop.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
“...posing as potential employers and sending malware disguised as coding challenges... require developers to run a compromised project...” ; “...ran the script without inspecting its contents... hidden malware... credentials... stolen...”
Slow Pisces began by impersonating recruiters on LinkedIn and engaging with potential targets, sending them a benign PDF with a job description... attackers presented them with a coding challenge... which links to a GitHub repository.
The repositories contained code adapted from open-source projects... The malicious command-and-control (C2) server is configured to mimic the format of the legitimate sources... domains... frequently using subdomains like .api or .cdn.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RN Loader is a Python-based loader used by TraderTraitor to deliver second-stage payloads to compromised systems, often as part of a multi-stage attack chain targeting developers and cloud environments.
First-stage loader used in TraderTraitor’s fake coding challenge campaign to collect basic system information and connect to command-and-control infrastructure.
Loader malware used by North Korean threat actors to infect systems, typically as part of a multi-stage attack targeting cryptocurrency developers.
Malware used in a developer-targeting social engineering campaign (coding-challenge lure) to infect systems and likely stage/fetch additional payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.