WindShift APT's macOS backdoor OSX.WindTail exposed
Objective-See publicly released and analyzed samples of OSX.WindTail, the macOS backdoor used by WindShift APT against Middle Eastern government targets.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Building on prior research by Taha Karim (DarkMatter) presented at Hack in the Box Singapore, Objective-See researchers located and publicly shared four previously-unreleased samples of OSX.WindTail on VirusTotal, confirming them as variants of the WindShift APT group's macOS implant. The malware masquerades as Microsoft Office documents, uses revoked Apple developer certificates, and abuses the LSSharedFileListInsertItemURL API to persist as a login item. Notably, three of the four samples were undetected by any anti-virus engine on VirusTotal at time of writing, despite Apple having revoked the signing certificates - suggesting a gap in threat-intel sharing between Apple and the AV community.
Technical analysis revealed the implant decrypts strings and C2 configuration using a hardcoded AES key identical to one previously shown in Karim's research, strongly tying the new samples to WindShift. Decrypted strings reference file extensions of espionage interest (doc, pdf, db) and two C2 domains, flux2key.com and string2me.com, both previously identified by Karim as WindShift infrastructure. At the time of analysis both domains were offline, limiting dynamic observation of C2 command execution, but static analysis suggests standard backdoor capabilities including file exfiltration and remote command execution.
WindShift is described as a highly-targeted cyber-espionage group focused on individuals in government departments and critical infrastructure organizations in the Middle East. The blog notes that Objective-See's free tools (BlockBlock, KnockKnock) can heuristically detect this malware absent signature-based AV coverage, and provides manual indicators (suspicious Login Items, Office-icon apps with invalid signatures in ~/Library/) for self-triage.
Mentioned in this report
Detection guidance
macOS Login Item Creation via LSSharedFileListInsertItemURL
A behavioural hunt for the technique in general.
Detects suspicious processes invoking LSSharedFileListInsertItemURL API to register persistence as a login item - typical for macOS backdoors establishing boot-time execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Login Item Creation via LSSharedFileListInsertItemURL
description: Detects processes calling LSSharedFileListInsertItemURL API to insert
login items, a technique used by macOS backdoors to establish persistence across
reboots. Generalises on the distinctive API call pattern rather than specific application
names or paths.
tags:
- attack.persistence
- attack.t1647
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains: LSSharedFileListInsertItemURL
filter_legitimate:
Image|contains:
- /Library/Frameworks/
- /System/Library/
condition: selection and not filter_legitimate
falsepositives:
- Legitimate system utilities or installers registering login items via the API
- Third-party security software managing login items programmatically
level: medium
id: 7849faf0-c3c1-5f41-93d0-da6919d15ace
status: experimental
author: Vorant
Suspicious Application Masquerading as Microsoft Office Document
A behavioural hunt for the technique in general.
Detects executable files with Office document icons or naming schemes (.doc, .pdf, .xls) containing mach-o binaries - masquerading technique to deceive users. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Application Masquerading as Microsoft Office Document
description: Detects executables or bundles disguised with Microsoft Office document
names or icons (e.g., app bundles with .doc/.docx/.xls in the name containing mach-o
binaries). Attackers use this to trick users into launching malware disguised as
benign documents.
tags:
- attack.stealth
- attack.t1036.005
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- .doc
- .docx
- .xls
- .xlsx
- .pdf
CommandLine|contains|all:
- /Contents/MacOS/
filter_legitimate:
ParentImage|contains:
- /Applications/Microsoft Office/
- /Applications/LibreOffice/
condition: selection and not filter_legitimate
falsepositives:
- Custom document conversion utilities with misleading naming
- Development or testing scenarios involving document-named bundles
level: high
id: 4b264c8b-9a92-5158-a4d7-8ecb8fc85f65
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x3B.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs