# GravityRAT spyware ports to macOS

Published: 2020-11-03 · Severity: medium · Sectors: defense
Canonical: https://vorant.io/reports/1416ee87-0012-521b-900b-5abd75b8586b/gravityrat-spyware-ports-to-macos

> Researchers dissected macOS variants of GravityRAT spyware, disguised as secure file-sharing apps, that root the Mac and persist via cron jobs.

Objective-See expanded on Kaspersky's discovery that GravityRAT, a cross-platform spyware historically used against the Indian armed forces, now has native macOS builds. Four unsigned Mach-O samples (Enigma, OrangeVault, StrongBox, TeraSpace) were obtained, all packaged with PyInstaller from Python source, masquerading as a secure file-sharing/anti-ransomware utility distributed from enigma.net.in.

The analysis traced the malware's execution chain: on first run without root, it drops a helper app bundle containing a compiled AppleScript that prompts the user for administrator credentials, relaunching the malware with root privileges via `do shell script ... with administrator privileges`. Once elevated, the malware fingerprints the host (product name, board ID, model) and beacons to a hardcoded C2 endpoint (download.enigma.net.in). It also checks for Full Disk Access by probing ~/Library/Safari and, if missing, prompts the user to manually grant Terminal.app that permission — a technique for bypassing macOS TCC protections through social engineering rather than exploitation.

For persistence, the malware installs a cron job (`*/2 * * * *`) via `sudo crontab` to execute a downloaded second-stage payload, which was not recovered in this investigation. Most of the compiled Python and UI code was legitimate-looking, intended to keep victims unaware the application is malicious. The behavior is detectable by monitoring tools such as BlockBlock that flag cronjob persistence.

## Mentioned in this report

- Malware: GravityRAT

Source reporting: https://objective-see.org/blog/blog_0x5B.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1416ee87-0012-521b-900b-5abd75b8586b/gravityrat-spyware-ports-to-macos.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup