Malware
SimpleTea
aka PondRAT · SimplexTea
SimpleTea for Linux is an HTTP(S) RAT. It was discovered in Q1 2023 as an instance of the Lazarus group's Operation DreamJob campaign for Linux.
SimpleTea, also known as PondRAT, SimplexTea, is a Linux malware family operated by Lazarus Group.
Background
SimpleTea for Linux is a RAT that communicates over HTTP(S).
It surfaced in Q1 2023 as part of the Lazarus group's Linux variant of the Operation DreamJob campaign, arriving as a payload in an execution chain that began with an HSBC-branded job-offer lure. Around the same period it used the same C&C server as payloads tied to the 3CX incident.
Built as an object-oriented project, it will not run on Linux distributions lacking a graphical user interface, and it decrypts its configuration from /home/%user%/.config/apdl.cf using 0x7E as the XOR key. Its network traffic is protected with AES-GCM.
The RAT handles a set of basic commands covering filesystem operations on the victim, configuration changes, file exfiltration through ZIP archives, and downloading and running further attacker tools. These commands are referenced by 16-bit integers beginning at 0x27C3.
Shared class and function names suggest SimpleTea for Linux is a reworked BadCall for Linux, ported from C to C++.
Source: Malpedia (Fraunhofer FKIE).