Elastic Security Labs exposes an attempt by the DPRK to infect blockchain engineers with novel macOS malware.

Preamble

Key takeaways

Execution flow

Stage 0 Initial compromise: Watcher.py

Stage 1 droppers testSpeed.py and FinderTools

Stage 2 payload .sld and .log: SUGARLOADER

Obfuscation

Execution

Stage 3 loader Discord: HLOADER

Persistence

Stage 4 Payload: KANDYKORN

Command and control

Command 0xD1

Command 0xD2

Command 0xD3

Command 0xD4

Command 0xD5

Command 0xD6

Command 0xD7

Command 0xD8

Command 0xD9

Command 0xDA

Command 0xDB

Command 0xDC

Command 0xDD

Command 0xDE

Command 0xDF

Command 0xE0

Summary

Network protocol

Network infrastructure

tp-globa[.]xyz

23.254.226[.]90

Campaign intersections

The Diamond Model

[Malware] and MITRE ATT&CK

Tactics

Techniques

Malware prevention capabilities

Malware detection capabilities

Hunting queries

EQL queries

YARA

Observations

References

Elastic catches DPRK passing out KANDYKORN

Watch out! We’ve recently discovered a variant of RUSTBUCKET. Read this article to understand the new capabilities we’ve observed, as well as how to identify it in your own network.

RUSTBUCKET code analysis

Overview

Stage 1

Stage 2

Stage 3

Command ID 0x31

Command ID 0x30

The undetected version of RUSTBUCKET

RUSTBUCKET and REF9135 analysis

Networking infrastructure

Defense evasion

Victimology

Observed adversary tactics and techniques

Diamond model

Detection logic

Prevention

A DPRK campaign using a new variant of the RUSTBUCKET malware is underway with updated capabilities and reduced signature detection.

The DPRK strikes using a new variant of RUSTBUCKET

Explore JOKERSPY, a recently discovered campaign that targets financial institutions with Python backdoors. This article covers reconnaissance, attack patterns, and methods of identifying JOKERSPY in your network.

Analysis

The xcc binary

XCode artifacts

Abusing TCC

Initial access

Deployed cryptographic libraries

The sh.py backdoor

Swiftbelt

Diamond Model

Observed tactics and techniques

MITRE ATT&CK Tactics

MITRE ATT&CK Techniques / Sub techniques

An overview of JOKERSPY, discovered in June 2023, which deployed custom and open source macOS tools to exploit a cryptocurrency exchange located in Japan.

Initial research exposing JOKERSPY

Author

Ricardo Ungureanu

Articles

Elastic catches DPRK passing out KANDYKORN

The DPRK strikes using a new variant of RUSTBUCKET

Initial research exposing JOKERSPY