# Code of Conduct: DPRK’s Python-fueled intrusions into secured networks

DPRK fake job-interview Python challenge ships a trojanized Pyperclip module that ROT13/Base64-decodes a C2 beacon and execs remote Python for RCE.

- Payout: Real-world hack
- Program: DPRK VMConnect campaign
- Credited: Colson Wilhoit
- Disclosed: 2024-09-18
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/dprk-code-of-conduct
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dprk-code-of-conduct
- Tags: domain:desktop impact:internal-access impact:rce kind:incident platform:threat-intel tech:python technique:chained technique:reverse-engineering technique:source-review vuln:rce vuln:secrets-leak

**Target:** Python developer workstation via malicious PyPI-style package in interview zip
**Root cause:** Trojanized third-party module (Pyperclip) in a delivered zip contains a Base64 blob that is written to temp and executed; the decoded script beacons to a ROT13-obfuscated C2 and exec()s Base64 payloads returned by the server.
**Steps:**
1. Victim receives RookeryCapital_PythonTest.zip posing as Capital One interview challenge; README instructs running before editing.
2. PasswordManager.py imports bundled Pyperclip; __init__.py imports base64, codecs, subprocess, tempfile.
3. cert_acc() decodes req_self Base64 blob, writes it to tempdir as rebase.tmp, and launches it via subprocess.Popen (DETACHED_PROCESS on Windows, shell=True+setpgrp on Unix).
4. Decoded script ROT13-decodes `uggcf://nxnznvgrpuabybtvrf.bayvar/` to C2 URL and builds data `Amazon.com`+uid+`pfrr`+OS flag.
5. Loop POSTs to C2; if response starts with ROT13 `Tbbtyr.pbz` and len>15, strips 10 chars, Base64-decodes, and `exec(compile(dec_res,'','exec'), globals())`.
6. Attacker returns arbitrary Python in the response body to run commands, write/execute files, or open interactive shells.
**How found:** Analyst noticed README urging users to run before editing, then flagged suspicious imports (base64, codecs, subprocess, tempfile) in Pyperclip and a large Base64 blob req_self; decoding revealed the ROT13-obfuscated C2 beacon.
**Exploitation:** Social engineering: fake recruiter sends zip as coding test; victim runs PasswordManager, which silently spawns the beacon from temp, polls C2 every 1-60s, and executes attacker-supplied Python payloads for full RCE and post-exploitation.
**Escalation:** Beacon supports arbitrary remote Python, enabling interactive shells, system binary execution (screencapture, security, dscl), and dropping executables in temp.
**Insight:** In third-party Python packages, treat imports of codecs+base64+subprocess+tempfile together as a red flag; decode any large Base64 string constant and grep for ROT13-looking hostnames (e.g. `uggcf`) to unmask C2 before running interview/recruiter code.