North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught
The post-exploitation backdoor is the latest in a string of custom tools aimed at spying on Apple users.
January 5, 2024
The prolific North Korean state-backed threat actor known as TA444 is back with shiny new malware for targeting macOS users, dubbed "SpectralBlur." The custom tool is the latest in a string of proprietary malware that the advanced persistent threat (APT) group has been consistently generating — a trait that sets it apart from other DPRK-sponsored threats.
According to Proofpoint threat researcher Greg Lesnewich, TA444 (aka APT38, BlueNoroff, BlackAlicanto, Coperenicum, Sapphire Sleet, and Stardust Chollima) debuted the SpectralBlur malware in August. It's a "moderately capable backdoor, that can upload/download files, run a shell, update its configuration, delete files, hibernate, or sleep, based on commands issued from the [command-and-control server]," he explained in a post on his personal blog this week.
TA444 often shares overlaps with its well-known cousin APT, Lazarus Group. For instance, Lesnewich noted that SpectralBlur malware contains similar strings within its code to the KandyKorn macOS data stealer, which emerged in early November in Lazarus Group campaigns used to target blockchain engineers connected to cryptocurrency exchanges. Proofpoint was subsequently able to link KandyKorn back to TA444 as well, via a phishing campaign analysis.
SpectralBlur is just the latest tool designed to go after macOS users, who are becoming a particular focus for North Korean nation-state attackers. "TA444 keeps running fast and furious with these new macOS malware families," Lesnewich wrote.
Earlier analysis from Proofpoint pointed out that malware creation — particularly in the form of post-exploitation backdoors like SpectralBlur and KandyKorn — is where TA444 really stands out, suggesting "that there is an embedded, or at least a devoted, malware development element alongside TA444 operators."
About the Author
You May Also Like
The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024The Right Way to Use Artificial Intelligence and Machine Learning in Incident Response
Nov 20, 2024Safeguarding GitHub Data to Fuel Web Innovation
Nov 21, 2024