Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 2 actors

RN Loader

RN Loader is a Python-based malware loader used by the North Korean state-sponsored threat group Slow Pisces, also known as Jade Sleet, TraderTraitor, and PUKCHONG, in campaigns targeting cryptocurrency developers. In the reported activity, operators impersonated recruiters on LinkedIn and delivered trojanized coding challenges via GitHub repositories. In the Python infection chain, attacker-controlled data fetched from en.stockslab[.]org was deserialized through unsafe PyYAML yaml.load() usage, resulting in execution of a YAML payload that created ~/Public/init.py, wrote embedded Base64-decoded data to it, and executed it as RN Loader. The loader then deleted itself after execution so that it existed solely in memory. RN Loader sent basic victim and operating system information over HTTPS to the same C2 domain, en.stockslab[.]org, and entered a command loop. Reported command capabilities included sleeping, loading and executing a DLL or binary, executing Base64-decoded Python code via exec, launching files named dockerd and docker-init, and terminating execution. Unit 42 linked RN Loader to selective payload delivery against validated victims and recovered a later-stage Python infostealer, RN Stealer, delivered through the loader. Associated hashes mentioned in the reporting are SHA256 937c533bddb8bbcd908b62f2bf48e5bc11160505df20fea91d9600d999eafa79 for RN Loader and SHA256 47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f for the preceding YAML deserialization payload. Supporting reporting also describes RN Loader and RN Stealer as part of a malware arsenal used to harvest SSH keys, saved credentials, and cloud service configurations from compromised developer workstations.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Lazarus

The YAML deserialization payload executes malware we have named RN Loader and RN Stealer based on the C2 token format we observed in RN Stealer. ... This newly created file for RN Loader at ~/Public/__init__.py deletes itself after execution, ensuring that it exists solely in memory. It sends basic information about the victim machine and operating system over HTTPS to the same C2 at en.stockslab[.]org, followed by a command loop.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com
TraderTraitor

The YAML deserialization payload executes malware we have named RN Loader and RN Stealer based on the C2 token format we observed in RN Stealer. ... This newly created file for RN Loader at ~/Public/__init__.py deletes itself after execution, ensuring that it exists solely in memory. It sends basic information about the victim machine and operating system over HTTPS to the same C2 at en.stockslab[.]org, followed by a command loop.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com
MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

4 techniques
T1195Supply Chain CompromiseEvidence1

“...posing as potential employers and sending malware disguised as coding challenges... require developers to run a compromised project...” ; “...ran the script without inspecting its contents... hidden malware... credentials... stolen...”

T1199Trusted RelationshipEvidence1

Slow Pisces began by impersonating recruiters on LinkedIn and engaging with potential targets, sending them a benign PDF with a job description... attackers presented them with a coding challenge... which links to a GitHub repository.

T1566.002Spearphishing LinkEvidence1

The question sheets include generic software development tasks and a “real project” coding challenge, which links to a GitHub repository.

T1566.003Spearphishing via ServiceEvidence1

Slow Pisces engaged with cryptocurrency developers on LinkedIn, posing as potential employers and sending malware disguised as coding challenges.

Execution

1 technique
T1059.006PythonEvidence1

The deserialization payload establishes a command loop with the C2 server... delivering a custom Python infostealer via option code 2... Base64-decodes sent content and executes it using the Python built-in exec.

Stealth

3 techniques
T1036MasqueradingEvidence1

The repositories contained code adapted from open-source projects... The malicious command-and-control (C2) server is configured to mimic the format of the legitimate sources... domains... frequently using subdomains like .api or .cdn.

T1070.004File DeletionEvidence1

This newly created file for RN Loader at ~/Public/__init__.py deletes itself after execution, ensuring that it exists solely in memory.

T1620Reflective Code LoadingEvidence1

The following stages in Table 1 exist primarily in memory and generally have no footprint on disk... Delivery of payloads at each stage is heavily guarded, existing in memory only.

Discovery

1 technique
T1082System Information DiscoveryEvidence1

It sends basic information about the victim machine and operating system... RN Stealer... steal[s] information specific to macOS devices, including: Basic victim information: Username, machine name and architecture Installed applications

Command and Control

2 techniques
T1071.001Web ProtocolsEvidence1

It sends basic information about the victim machine and operating system over HTTPS to the same C2... Communication with the C2 server occurs over HTTPS, using Base64-encoded tokens to identify request and response types.

T1105Ingress Tool TransferEvidence1

Base64-decodes sent content and saves it to the file init.dll for Windows or init for all other operating systems... Loads and executes the downloaded DLL... Content is saved to the file dockerd... dockerd is then executed in a new process.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
hash.sha256●●●●●●●●●●●●View more in app1 year ago
hash.sha256●●●●●●●●●●●●View more in app1 year ago
domain●●●●●●●●●●●●View more in app1 year ago
uri●●●●●●●●●●●●View more in app1 year ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.