VORANT. Threat Intelligence Sign in Get the full feed

Lazarus UpdateAgent profiles 3CX macOS victims

routine threat telecommunicationstechnology

Objective-See analyzed UpdateAgent, the second-stage macOS payload in the Lazarus Group's 3CX supply-chain attack, which exfiltrates victim data to a hard-coded C2 endpoint.

This post continues Objective-See's analysis of the macOS component of the 3CX supply-chain compromise, attributed to North Korea's Lazarus Group. Having previously analyzed the first-stage payload (libffmpeg.dylib), the author obtained and reverse-engineered the second-stage payload, UpdateAgent, an adhoc-signed x86_64 Mach-O binary that was downloaded and executed by the first stage.

UpdateAgent employs basic anti-analysis techniques including forking and self-deletion via unlink to evade file-based AV detection. It reads a legitimate 3CX configuration file (config.json) to extract the provisioning URL and account name, then reads a victim-unique UUID from a locally-stored .main_storage file (XOR-encoded with key 0x7a, written by the first-stage payload). This data is encrypted and combined into a parameterized cookie string, then exfiltrated via HTTP POST to the hard-coded endpoint sbmsa.wiki/blog/_insert using a spoofed Chrome/Windows user-agent.

At analysis time the attacker's C2 infrastructure was offline, preventing observation of any response-handling logic; static analysis showed the malware simply exits after the POST, suggesting UpdateAgent's sole purpose is victim profiling/reconnaissance for a mass supply-chain campaign, allowing Lazarus to later selectively deploy more capable implants to targets of interest. The author provides file and network IOCs and demonstrates detection/protection via Objective-See's free tools (BlockBlock, DNSMonitor, LuLu).

Mentioned in this report

Threat actors Lazarus Group
Malware AppleJeusUpdateAgentlibffmpeg.dylib
Campaigns 3CX Supply Chain Attack3CXpocalypse

Detection guidance

UpdateAgent Self-Deletion via unlink After Execution

ATT&CK T1070.004

macOS process deleting itself via unlink() syscall post-execution, characteristic of Lazarus UpdateAgent and similar supply-chain malware evading file-based detection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: UpdateAgent Self-Deletion via unlink After Execution
description: Detects a process calling unlink() on its own binary path or parent process
  binary, a technique used by UpdateAgent and similar supply-chain malware to evade
  file-based AV after execution.
tags:
- attack.defense-evasion
- attack.t1070.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    EventType: execve
    Image|endswith: UpdateAgent
  syscall_unlink:
    SyscallName: unlink
    SyscallArg|contains:
    - UpdateAgent
    - libffmpeg.dylib
  condition: selection and syscall_unlink
falsepositives:
- Legitimate self-updating macOS applications that delete outdated versions
- Build systems cleaning temporary binaries
level: high
id: 97d78191-dae9-5c0d-8cf5-02e38c79c917
status: experimental
author: Vorant

Suspicious HTTP POST to C2 with Spoofed Chrome User-Agent

ATT&CK T1071.001

Process making HTTP POST request with Chrome/Windows user-agent to exfiltrate data, typical of UpdateAgent C2 communication masquerading as browser traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious HTTP POST to C2 with Spoofed Chrome User-Agent
description: Detects HTTP POST requests with spoofed Chrome/Windows user-agent, commonly
  used by UpdateAgent and supply-chain malware to blend in with legitimate browser
  traffic while exfiltrating victim profiling data.
tags:
- attack.command-and-control
- attack.exfiltration
- attack.t1071.001
- attack.t1041
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    DestinationPort: 80
    Protocol: HTTP
    HttpMethod: POST
    UserAgent|contains:
    - Chrome
    - Windows
  filter_legitimate_chrome:
    Image|endswith:
    - /Chrome
    - /Chromium
    - /Google Chrome Helper
  condition: selection and not filter_legitimate_chrome
falsepositives:
- Third-party macOS applications using Chrome user-agent for compatibility
- Legitimate cross-platform tools bundling Chrome user-agent strings
level: medium
id: 170cf9fe-80e6-5c1a-94d1-9fac99b29e09
status: experimental
author: Vorant

Process Reading XOR-Encoded Local Storage and Extracting Config Data

ATT&CK T1005

Process reading .main_storage file and config.json in sequence, extracting sensitive data and preparing for exfiltration, indicative of UpdateAgent reconnaissance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Reading XOR-Encoded Local Storage and Extracting Config Data
description: Detects a process reading both a 3CX config.json file and a .main_storage
  (XOR-encoded credential/UUID storage), typical reconnaissance pattern of UpdateAgent
  before data exfiltration.
tags:
- attack.collection
- attack.t1005
logsource:
  category: file_event
  product: macos
detection:
  selection_config:
    FileName|endswith: config.json
    Action: read
  selection_storage:
    FileName|endswith: .main_storage
    Action: read
  filter_legitimate:
    Image|endswith:
    - /3CX
    - /3CXPhone
    - /Finder
  condition: (selection_config and selection_storage) and not filter_legitimate
falsepositives:
- Legitimate 3CX client reads during normal initialization
- Configuration management tools bundling 3CX profiles
level: medium
id: 9649eb51-1575-5fea-bcae-6a1c4d4932c6
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x74.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free