216.73.217.22

PondRAT

AlienVault · Published 20/12/2025 19:46 · Modified 29/05/2026 12:20

Essential information

Confidence
100/100
Is family
No
Published
20/12/2025 19:46
Modified
29/05/2026 12:20
Revoked
No
Author / Source
AlienVault
Related entities
45 attack patterns (mitre), 3 intrusion sets (apt), 2 sectors, 71 indicators, 3 vulnerabilities (cve), 4 reports

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.

Attack patterns (MITRE) (45)

  • T1059.004 uses
    Unix Shell
  • T1486 uses
    Data Encrypted for Impact
  • T1562.006 uses
    Indicator Blocking
  • T1057 uses
    Process Discovery
  • T1105 uses
    Ingress Tool Transfer
  • T1102 uses
    Web Service
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1059 uses
    Command and Scripting Interpreter
  • T1543.001 uses
    Launch Agent
  • T1518 uses
    Software Discovery
  • T1562.001 uses
    Disable or Modify Tools
  • T1070 uses
    Indicator Removal
  • T1083 uses
    File and Directory Discovery
  • T1055 uses
    Process Injection
  • T1497 uses
    Virtualization/Sandbox Evasion
  • T1562 uses
    Impair Defenses
  • T1574.002 uses
  • T1009 uses
  • T1045 uses
  • T1573 uses
    Encrypted Channel
  • T1071 uses
    Application Layer Protocol
  • T1053 uses
    Scheduled Task/Job
  • T1082 uses
    System Information Discovery
  • T1005 uses
    Data from Local System
  • T1560 uses
    Archive Collected Data
  • T1132 uses
    Data Encoding
  • T1027 uses
    Obfuscated Files or Information
  • T1204.002 uses
    Malicious File
  • T1195.002 uses
    Compromise Software Supply Chain
  • T1219 uses
    Remote Access Tools
  • T1036.004 uses
    Masquerade Task or Service
  • T1071.001 uses
    Web Protocols
  • T1210 uses
    Exploitation of Remote Services
  • T1036 uses
    Masquerading
  • T1543.003 uses
    Windows Service
  • T1480.001 uses
    Environmental Keying
  • T1106 uses
    Native API
  • T1588.002 uses
    Tool
  • T1059.006 uses
    Python
  • T1543 uses
    Create or Modify System Process
  • T1571 uses
    Non-Standard Port
  • T1041 uses
    Exfiltration Over C2 Channel
  • T1204 uses
    User Execution
  • T1027.002 uses
    Software Packing
  • T1564 uses
    Hide Artifacts

Intrusion sets (APT) (3)

  • Various North Korean groups under the Reconnaissance General Bureau uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 06:57 · Modified 21/12/2025 06:57
  • Gleaming Pisces uses UNC1720UNC4736
    The MITRE Corporation Confidence 100

    [AppleJeus](https://attack.mitre.org/groups/G1049) is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader [Lazarus Group](https://attack.mitre.org/groups/G0032) umbrella of actors, [AppleJeus](https://attack.mitre.org/groups/G1049) has been active since …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:39 · Modified 04/05/2026 16:59
  • Lazarus uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 21:17 · Modified 29/05/2026 12:20

Sectors (2)

  • Finance targets
  • Technology targets

Indicators (71)

Vulnerabilities (CVE) (3)

CVE-2025-55182 KEV
10.0 Critical

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …

Attack vector
Network
Published
05/12/2025
Modified
29/05/2026
Analyzed
CVE-2024-3094
10.0 Critical

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma …

Attack vector
NETWORK
Published
29/03/2024
Modified
21/12/2025
CVE-2024-3400 KEV
10.0 Critical

Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges …

Attack vector
Network
Published
12/04/2024
Modified
21/12/2025

Reports (4)