Lazarus UpdateAgent profiles 3CX macOS victims

Objective-See analyzed UpdateAgent, the second-stage macOS payload in the Lazarus Group's 3CX supply-chain attack, which exfiltrates victim data to a hard-coded C2 endpoint.

This post continues Objective-See's analysis of the macOS component of the 3CX supply-chain compromise, attributed to North Korea's Lazarus Group. Having previously analyzed the first-stage payload (libffmpeg.dylib), the author obtained and reverse-engineered the second-stage payload, UpdateAgent, an adhoc-signed x86_64 Mach-O binary that was downloaded and executed by the first stage.

UpdateAgent employs basic anti-analysis techniques including forking and self-deletion via unlink to evade file-based AV detection. It reads a legitimate 3CX configuration file (config.json) to extract the provisioning URL and account name, then reads a victim-unique UUID from a locally-stored .main_storage file (XOR-encoded with key 0x7a, written by the first-stage payload). This data is encrypted and combined into a parameterized cookie string, then exfiltrated via HTTP POST to the hard-coded endpoint sbmsa.wiki/blog/_insert using a spoofed Chrome/Windows user-agent.

At analysis time the attacker's C2 infrastructure was offline, preventing observation of any response-handling logic; static analysis showed the malware simply exits after the POST, suggesting UpdateAgent's sole purpose is victim profiling/reconnaissance for a mass supply-chain campaign, allowing Lazarus to later selectively deploy more capable implants to targets of interest. The author provides file and network IOCs and demonstrates detection/protection via Objective-See's free tools (BlockBlock, DNSMonitor, LuLu).

Source reporting: https://objective-see.org/blog/blog_0x74.html