GravityRAT spyware ports to macOS
Researchers dissected macOS variants of GravityRAT spyware, disguised as secure file-sharing apps, that root the Mac and persist via cron jobs.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Objective-See expanded on Kaspersky's discovery that GravityRAT, a cross-platform spyware historically used against the Indian armed forces, now has native macOS builds. Four unsigned Mach-O samples (Enigma, OrangeVault, StrongBox, TeraSpace) were obtained, all packaged with PyInstaller from Python source, masquerading as a secure file-sharing/anti-ransomware utility distributed from enigma.net.in.
The analysis traced the malware's execution chain: on first run without root, it drops a helper app bundle containing a compiled AppleScript that prompts the user for administrator credentials, relaunching the malware with root privileges via `do shell script ... with administrator privileges`. Once elevated, the malware fingerprints the host (product name, board ID, model) and beacons to a hardcoded C2 endpoint (download.enigma.net.in). It also checks for Full Disk Access by probing ~/Library/Safari and, if missing, prompts the user to manually grant Terminal.app that permission — a technique for bypassing macOS TCC protections through social engineering rather than exploitation.
For persistence, the malware installs a cron job (`*/2 * * * *`) via `sudo crontab` to execute a downloaded second-stage payload, which was not recovered in this investigation. Most of the compiled Python and UI code was legitimate-looking, intended to keep victims unaware the application is malicious. The behavior is detectable by monitoring tools such as BlockBlock that flag cronjob persistence.
Mentioned in this report
Detection guidance
macOS AppleScript Prompt for Elevated Execution
A behavioural hunt for the technique in general.
Detects use of AppleScript 'do shell script with administrator privileges' to re-execute a process with root elevation via user prompt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS AppleScript Prompt for Elevated Execution
description: Detects AppleScript invoking 'do shell script ... with administrator
privileges' to elevate a process by prompting the user for credentials. This is
typical of GravityRAT and similar macOS spyware that lack native privilege escalation
exploits and must socially engineer elevation.
tags:
- attack.privilege-escalation
- attack.t1548.004
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains|all:
- do shell script
- with administrator privileges
condition: selection
falsepositives:
- Legitimate macOS utilities (installer scripts, system preferences) using AppleScript
for admin tasks
- IT management tools that require elevation via user prompt
level: medium
id: 74a81f8b-5585-5b5b-8d9b-10a04894eb55
status: experimental
author: Vorant
Cron Job Installation via sudo crontab
A behavioural hunt for the technique in general.
Detects installation of a cron job via sudo crontab -e or sudo crontab -i, indicative of persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cron Job Installation via sudo crontab
description: Detects invocation of 'sudo crontab' with -e (edit) or -i (install) flags
to persist a scheduled task via cron. GravityRAT and other macOS spyware use this
to execute second-stage payloads at regular intervals (e.g., */2 * * * * for every
2 minutes).
tags:
- attack.persistence
- attack.t1053.003
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /crontab
CommandLine|contains:
- ' -e'
- ' -i'
condition: selection
falsepositives:
- System administrators legitimately managing cron jobs
- Automation frameworks (Ansible, Puppet) installing scheduled tasks
level: medium
id: 6bb9b0c3-35bb-5f7b-a842-b8665c286cd1
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x5B.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs