North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught
The post-exploitation backdoor is the latest in a string of custom tools aimed at spying on Apple users.
January 5, 2024
The prolific North Korean state-backed threat actor known as TA444 is back with shiny new malware for targeting macOS users, dubbed "SpectralBlur." The custom tool is the latest in a string of proprietary malware that the advanced persistent threat (APT) group has been consistently generating — a trait that sets it apart from other DPRK-sponsored threats.
According to Proofpoint threat researcher Greg Lesnewich, TA444 (aka APT38, BlueNoroff, BlackAlicanto, Coperenicum, Sapphire Sleet, and Stardust Chollima) debuted the SpectralBlur malware in August. It's a "moderately capable backdoor, that can upload/download files, run a shell, update its configuration, delete files, hibernate, or sleep, based on commands issued from the [command-and-control server]," he explained in a post on his personal blog this week.
TA444 often shares overlaps with its well-known cousin APT, Lazarus Group. For instance, Lesnewich noted that SpectralBlur malware contains similar strings within its code to the KandyKorn macOS data stealer, which emerged in early November in Lazarus Group campaigns used to target blockchain engineers connected to cryptocurrency exchanges. Proofpoint was subsequently able to link KandyKorn back to TA444 as well, via a phishing campaign analysis.
SpectralBlur is just the latest tool designed to go after macOS users, who are becoming a particular focus for North Korean nation-state attackers. "TA444 keeps running fast and furious with these new macOS malware families," Lesnewich wrote.
Earlier analysis from Proofpoint pointed out that malware creation — particularly in the form of post-exploitation backdoors like SpectralBlur and KandyKorn — is where TA444 really stands out, suggesting "that there is an embedded, or at least a devoted, malware development element alongside TA444 operators."
About the Author(s)
You May Also Like
Why Effective Asset Management is Critical to Enterprise Cybersecurity
May 21, 2024Finding Your Way on the Path to Zero Trust
May 22, 2024Extending Access Management: Securing Access for all Identities, Devices, and Applications
June 4, 2024Assessing Software Supply Chain Risk
June 6, 2024Preventing Attackers From Wandering Through Your Enterprise Infrastructure
June 19, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024