Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware

Slow Pisces (aka Jade Sleet/TraderTraitor/PUKCHONG), a North Korean state-sponsored threat actor, targeted cryptocurrency developers by posing as recruiters and sending benign-looking coding challenges that fetch data from attacker-controlled C2 domains; the campaign uses YAML deserialization in Python and EJS escapeFunction in JavaScript to execute in-memory payloads (RN Loader and RN Stealer). The report provides a technical analysis of the infection chain, malware behavior, infrastructure timeline, a table of IoCs, and mitigation recommendations including device segregation and detection points.