GravityRAT spyware ports to macOS

Researchers dissected macOS variants of GravityRAT spyware, disguised as secure file-sharing apps, that root the Mac and persist via cron jobs.

Objective-See expanded on Kaspersky's discovery that GravityRAT, a cross-platform spyware historically used against the Indian armed forces, now has native macOS builds. Four unsigned Mach-O samples (Enigma, OrangeVault, StrongBox, TeraSpace) were obtained, all packaged with PyInstaller from Python source, masquerading as a secure file-sharing/anti-ransomware utility distributed from enigma.net.in.

The analysis traced the malware's execution chain: on first run without root, it drops a helper app bundle containing a compiled AppleScript that prompts the user for administrator credentials, relaunching the malware with root privileges via `do shell script ... with administrator privileges`. Once elevated, the malware fingerprints the host (product name, board ID, model) and beacons to a hardcoded C2 endpoint (download.enigma.net.in). It also checks for Full Disk Access by probing ~/Library/Safari and, if missing, prompts the user to manually grant Terminal.app that permission — a technique for bypassing macOS TCC protections through social engineering rather than exploitation.

For persistence, the malware installs a cron job (`*/2 * * * *`) via `sudo crontab` to execute a downloaded second-stage payload, which was not recovered in this investigation. Most of the compiled Python and UI code was legitimate-looking, intended to keep victims unaware the application is malicious. The behavior is detectable by monitoring tools such as BlockBlock that flag cronjob persistence.

title: macOS AppleScript Prompt for Elevated Execution
description: Detects AppleScript invoking 'do shell script ... with administrator
  privileges' to elevate a process by prompting the user for credentials. This is
  typical of GravityRAT and similar macOS spyware that lack native privilege escalation
  exploits and must socially engineer elevation.
tags:
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains|all:
    - do shell script
    - with administrator privileges
  condition: selection
falsepositives:
- Legitimate macOS utilities (installer scripts, system preferences) using AppleScript
  for admin tasks
- IT management tools that require elevation via user prompt
level: medium
id: 74a81f8b-5585-5b5b-8d9b-10a04894eb55
status: experimental
author: Vorant

title: Cron Job Installation via sudo crontab
description: Detects invocation of 'sudo crontab' with -e (edit) or -i (install) flags
  to persist a scheduled task via cron. GravityRAT and other macOS spyware use this
  to execute second-stage payloads at regular intervals (e.g., */2 * * * * for every
  2 minutes).
tags:
- attack.persistence
- attack.t1053.003
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /crontab
    CommandLine|contains:
    - ' -e'
    - ' -i'
  condition: selection
falsepositives:
- System administrators legitimately managing cron jobs
- Automation frameworks (Ansible, Puppet) installing scheduled tasks
level: medium
id: 6bb9b0c3-35bb-5f7b-a842-b8665c286cd1
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x5B.html