Lazarus macOS malware executes payloads in memory
Lazarus Group's new macOS trojan, distributed via a fake crypto-trading app, downloads and runs payloads entirely from memory without touching disk.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Researchers analyzed a new macOS implant tied to Lazarus Group's ongoing AppleJeus campaign, distributed as a trojanized cryptocurrency trading application (UnionCryptoTrader.dmg) hosted on a purpose-built fake company site, unioncrypto.vip. The unsigned installer package drops a hidden launch daemon and a persistent binary (unioncryptoupdater) into /Library/UnionCrypto, which is executed at every boot to give Lazarus durable access to compromised crypto-exchange-adjacent hosts.
The binary performs basic system fingerprinting (hardware serial number and OS version via IOKit and SystemVersion.plist) and beacons to a C2 endpoint over HTTPS using libcurl. When the server responds with an encrypted payload rather than a placeholder '0', the malware decrypts it and uses NSCreateObjectFileImageFromMemory/NSLinkModule to map and execute the Mach-O payload directly from memory, parsing the LC_MAIN load command to locate and jump to its entry point — avoiding writing the second-stage payload to disk. If in-memory execution fails, the malware falls back to writing the payload to /tmp/updater and executing it via system() before deleting the file.
This in-memory loading technique, while previously discussed in offensive security research and seen in adware like InstallCore, had not previously been observed in public macOS malware, marking a notable evolution in Lazarus's toolset. The malware fits the group's established modus operandi of targeting cryptocurrency exchange employees with trojanized trading software, consistent with the broader AppleJeus operation first documented by Kaspersky. At the time of analysis the C2 server was live but not actively serving a second-stage payload.
Mentioned in this report
Detection guidance
Launch Daemon Creation in Non-Standard Library Path
A behavioural hunt for the technique in general.
Unsigned installer or trojanized app dropping launch daemon plist into /Library subdirectory for persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Launch Daemon Creation in Non-Standard Library Path
description: Detects creation of launch daemon plist files in /Library subdirectories
(excluding standard Apple locations) - typical persistence mechanism for trojanized
macOS installers. Monitors for .plist files written to /Library/* paths that contain
daemon configuration.
tags:
- attack.persistence
- attack.t1543.004
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- /Library/LaunchDaemons/
- /Library/LaunchAgents/
TargetFilename|endswith: .plist
filter_apple_official:
TargetFilename|startswith:
- /Library/LaunchDaemons/com.apple.
- /Library/LaunchAgents/com.apple.
filter_system_updates:
TargetFilename|contains:
- softwareupdate
- mdaemon
condition: selection and not (filter_apple_official or filter_system_updates)
falsepositives:
- Legitimate third-party software installers creating their own LaunchDaemons
- Enterprise management tools deploying persistent agents
level: medium
id: 092db678-4bbb-5ef5-be54-96a2b76d30fb
status: experimental
author: Vorant
Process Querying System Hardware and OS Information via IOKit
A behavioural hunt for the technique in general.
Unsigned binary reading hardware serial number and OS version for fingerprinting prior to beacon. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Querying System Hardware and OS Information via IOKit
description: Detects process accessing IOKit properties and SystemVersion.plist for
hardware/OS enumeration - typical reconnaissance before C2 communication in trojanized
macOS apps.
tags:
- attack.discovery
- attack.t1082
logsource:
category: process_creation
product: macos
detection:
selection_iokit:
CommandLine|contains:
- IOPlatformSerialNumber
- IOHardwareModel
- IOProductName
selection_sysversion:
CommandLine|contains: SystemVersion.plist
selection_defaults_read:
Image|endswith: /usr/bin/defaults
CommandLine|contains:
- IOPlatformSerialNumber
- IOHardwareModel
filter_legitimate_admin:
ParentImage|contains:
- /Applications/System Preferences.app
- /System/Applications/System Settings.app
- mdm
condition: (selection_iokit or selection_sysversion or selection_defaults_read)
and not filter_legitimate_admin
falsepositives:
- System profiling tools (Apple Diagnostic Utility, third-party inventory software)
- MDM agents performing legitimate hardware inventory
level: medium
id: ecf020d7-2af3-54f8-81fe-bfce9385c311
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x51.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs