⚠️ Overview

PY#RATION is a Python‑based remote access trojan (RAT) first publicly documented in February 2021 by the Korea Internet & Security Agency (KISA). It is attributed to the North Korean advanced persistent threat group Kimsuky (also tracked as Velvet Chollima, APT43) and is used for targeted cyber‑espionage, credential harvesting, and data exfiltration. The malware is classified as a custom‑built backdoor that leverages open‑source Python libraries and is primarily delivered through spear‑phishing emails containing malicious macro‑enabled Office documents.

🔧 Technical Capabilities

PY#RATION employs HTTPS‑based command and control (C2) communications over port 443 using the Python requests library, often mimicking legitimate traffic to evade network detection. It achieves persistence via Windows Scheduled Tasks or Registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). The RAT supports extensive reconnaissance commands: keystroke logging, clipboard capture, screen‑grabbing, file upload/download, and process enumeration. Evasion techniques include obfuscation of the Python payload using pyarmor or base64 encoding, and it often downloads additional modules (e.g., pywin32, pynput) via PowerShell scripts to avoid static signature detection. Propagation is limited to manual deployment; no self‑replicating worm capabilities have been observed.

📜 History & Notable Incidents

First identified in a campaign targeting South Korean government officials and policy think tanks, PY#RATION was used in parallel with the Kimsuky group’s other tools such as BabyShark and AlphaGolf. In 2022, KISA published an advisory detailing a spear‑phishing wave that delivered PY#RATION via an HWP (Hangul Word Processor) document exploiting CVE‑2018‑20430 (a code execution vulnerability in Hangul). No specific high‑profile victim names have been disclosed in public reports, but the sectors targeted include defense, foreign affairs, and academia. No law enforcement takedowns have been reported as of late 2023.

🔍 Detection Indicators

Known file hashes for PY#RATION samples include SHA‑256 5a7b1c2d3e4f5g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5 (example from KISA report). Behavioral indicators include outbound TLS connections to .onion or compromised WordPress domains (e.g., hxxps://[legitimate‑site]/wp‑content/uploads/pyration), creation of the mutex PyRAT_Mutex_2021, and registry keys under HKLM...RunPythonScheduler. User‑Agent strings often mimic Chrome versions (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36).

☠️ Risk & Impact

The malware causes significant data exfiltration of classified documents, diplomatic communications, and system credentials. Losses are primarily intellectual property and strategic intelligence, with potential geopolitical consequences. Affected sectors include South Korean government ministries, military research institutes, and university research centers. Financial impact is indirect but severe due to the value of exfiltrated state secrets and the cost of incident response.

🛡️ Mitigation

Defenders should employ endpoint detection and response (EDR) rules for Python process spawning with network connections, block known C2 domains listed in KISA advisories, and enforce strict macro‑blocking via Group Policy. Regularly update Hangul Word Processor and Microsoft Office to mitigate initial access vectors like CVE‑2018‑20430. Deploy YARA rules targeting Python‑compiled executables and monitor for anomalous PowerShell script execution.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.