North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught
The post-exploitation backdoor is the latest in a string of custom tools aimed at spying on Apple users.
January 5, 2024
![Blurred figure in a hoodie standing in a tunnel Blurred figure in a hoodie standing in a tunnel](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2824c10c8db9cf0b/65985081fa5809040a68de88/hoodie-alimdi.net-Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The prolific North Korean state-backed threat actor known as TA444 is back with shiny new malware for targeting macOS users, dubbed "SpectralBlur." The custom tool is the latest in a string of proprietary malware that the advanced persistent threat (APT) group has been consistently generating — a trait that sets it apart from other DPRK-sponsored threats.
According to Proofpoint threat researcher Greg Lesnewich, TA444 (aka APT38, BlueNoroff, BlackAlicanto, Coperenicum, Sapphire Sleet, and Stardust Chollima) debuted the SpectralBlur malware in August. It's a "moderately capable backdoor, that can upload/download files, run a shell, update its configuration, delete files, hibernate, or sleep, based on commands issued from the [command-and-control server]," he explained in a post on his personal blog this week.
TA444 often shares overlaps with its well-known cousin APT, Lazarus Group. For instance, Lesnewich noted that SpectralBlur malware contains similar strings within its code to the KandyKorn macOS data stealer, which emerged in early November in Lazarus Group campaigns used to target blockchain engineers connected to cryptocurrency exchanges. Proofpoint was subsequently able to link KandyKorn back to TA444 as well, via a phishing campaign analysis.
SpectralBlur is just the latest tool designed to go after macOS users, who are becoming a particular focus for North Korean nation-state attackers. "TA444 keeps running fast and furious with these new macOS malware families," Lesnewich wrote.
Earlier analysis from Proofpoint pointed out that malware creation — particularly in the form of post-exploitation backdoors like SpectralBlur and KandyKorn — is where TA444 really stands out, suggesting "that there is an embedded, or at least a devoted, malware development element alongside TA444 operators."
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024