macOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs

on YouTube ↗54m

" summary

Shows that nation-state Lazarus (AppleJeus) targets crypto investors on macOS with social‑engineered installers, C2 over .gif files, RC4/XOR encryption, and a second‑stage that only runs with a special argument to block sandboxes. Documents a 3CX supply‑chain compromise dropping signed libraries that load unsigned code, and xLoader delivered by JARs stealing browser cookies, tokens and clipboard contents via NSPasteboard. Lists affected sectors, describes hard‑to‑analyze obfuscation, and recommends managed macOS endpoint agents, network visibility and simple segmentation like separate browsers and rotating tokens with MFA.

AI-written summary · about

" chapters (18)

1. 0:00Intro
2. 0:51Is there anything like a "safe" platform?
3. 2:22No platform is "safe"
4. 3:06Types of Malware used during attacks
5. 6:03Lazarus : AppleJeus
6. 7:04AppleJeus : BTC pricing timeline
7. 11:23AppleJeus - Communication with the C2
8. 12:47AppleJeus - 2nd Stage Payload
9. 14:19AppleJeus: 2023 operations
10. 15:55Supply Chain Attack - 3CX VOIP (Lazarus' cluster)
11. 20:263CX macOS implant - 2nd stage drop
12. 21:193CX macOS 2nd stage implant analysis
13. 22:51xLoader - Background and Technical Analysis
14. 34:00macOS Infostealers: Common Delivery Mechanisms
15. 36:09Lockbit 3.0 - 1st macOS ransomware!
16. 38:28macOS: Identify Users and Assets at Risk
17. 39:35macOS: Mapped MITRE ATT&CK Techniques
18. 45:13Conclusions

" related talks

• 42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS PayloadsPatrick Wardle · Black Hat USA 2023
• 32mA Case Study of MacOS Supply Chain CompromiseMichael George, Jason Craig · BSidesSF 2018
• 49mLeveraging MacOS's Networking Frameworks to Heuristically Detect MalwarePatrick Wardle · RSA Conference 2024
• 45mKeynote Address: Click Here to Hack Your Target: A Perspective on the Past...Bill Marczak · 20th USENIX WOOT Conference on Offensive Technologies (WOOT '26)
• 42mKeynote: The Expanding Universe of Cyber ThreatsDr. Xena Olsen · BSidesSF 2023
• 33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...Jaromir Horejsi, Daniel Lunghi · 34th Annual FIRST Conference 2022
• 48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect MalwarePatrick Wardle · Black Hat USA 2023
• 42mStart Covering Your Bases And Stop Chasing APT HeadlinesAvishay Zawoznik · Global AppSec Lisbon 2024