# Lazarus UpdateAgent profiles 3CX macOS victims

Published: 2023-04-01 · Severity: high · Sectors: telecommunications, technology
Canonical: https://vorant.io/reports/51738f37-d85a-5dfc-82f5-f497e0274dd5/lazarus-updateagent-profiles-3cx-macos-victims

> Objective-See analyzed UpdateAgent, the second-stage macOS payload in the Lazarus Group's 3CX supply-chain attack, which exfiltrates victim data to a hard-coded C2 endpoint.

This post continues Objective-See's analysis of the macOS component of the 3CX supply-chain compromise, attributed to North Korea's Lazarus Group. Having previously analyzed the first-stage payload (libffmpeg.dylib), the author obtained and reverse-engineered the second-stage payload, UpdateAgent, an adhoc-signed x86_64 Mach-O binary that was downloaded and executed by the first stage.

UpdateAgent employs basic anti-analysis techniques including forking and self-deletion via unlink to evade file-based AV detection. It reads a legitimate 3CX configuration file (config.json) to extract the provisioning URL and account name, then reads a victim-unique UUID from a locally-stored .main_storage file (XOR-encoded with key 0x7a, written by the first-stage payload). This data is encrypted and combined into a parameterized cookie string, then exfiltrated via HTTP POST to the hard-coded endpoint sbmsa.wiki/blog/_insert using a spoofed Chrome/Windows user-agent.

At analysis time the attacker's C2 infrastructure was offline, preventing observation of any response-handling logic; static analysis showed the malware simply exits after the POST, suggesting UpdateAgent's sole purpose is victim profiling/reconnaissance for a mass supply-chain campaign, allowing Lazarus to later selectively deploy more capable implants to targets of interest. The author provides file and network IOCs and demonstrates detection/protection via Objective-See's free tools (BlockBlock, DNSMonitor, LuLu).

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: AppleJeus, UpdateAgent, libffmpeg.dylib
- Campaigns: 3CX Supply Chain Attack, 3CXpocalypse

Source reporting: https://objective-see.org/blog/blog_0x74.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/51738f37-d85a-5dfc-82f5-f497e0274dd5/lazarus-updateagent-profiles-3cx-macos-victims.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup