Lazarus deploys new AppleJeus variant via JMTTrading
Lazarus Group used a fake crypto-trading firm, JMT Trading, to distribute a new macOS AppleJeus backdoor with full remote command execution.
Researcher Patrick Wardle analyzed a new macOS malware sample, distributed via a trojanized cryptocurrency trading application called "JMTTrader," hosted on a fake company website (jmttrading.org) and a GitHub release page. The infection chain closely mirrors Kaspersky's previously documented "Operation AppleJeus" campaign, in which Lazarus Group created a fake company ("Celas Trade Pro") to trick cryptocurrency exchange employees into installing malicious trading software. The JMTTrader.pkg installer drops a launch daemon (org.jmttrading.plist) and a persistent Mach-O binary (CrashReporter) that requires a specific command-line argument to execute — a known Lazarus anti-analysis technique.
Once running, the CrashReporter binary contacts a hardcoded C2 (beastgoc.com, resolving to 185.228.83.32) over HTTPS, sending XOR-encrypted beacons containing a random token, version, and PID. The malware supports commands including exit, file upload (up), and arbitrary shell command execution via popen, giving an attacker full remote control of infected macOS hosts. While architecturally and functionally distinct from the previously analyzed Qt-based Lazarus backdoor (different commands, no cross-platform code, no system-recon functions), multiple design similarities — the fake-company lure, unsigned/ad-hoc-signed installer package, launch daemon persistence pattern, and command-line-argument gating logic — strongly tie this sample to the same actor.
At time of analysis the sample was undetected by all VirusTotal engines, though behavior-based tools (BlockBlock, LuLu, Netiquette) readily flagged the persistence and C2 activity. The malware appears targeted at employees of cryptocurrency exchanges rather than the general public, consistent with Lazarus's financially-motivated targeting of crypto infrastructure.
Mentioned in this report
Detection guidance
Network Connection to Hardcoded C2 with XOR-Encrypted Beacon Pattern
Detects outbound HTTPS connections from unsigned application binaries to known malicious domains — consistent with AppleJeus CrashReporter C2 beaconing behavior. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Network Connection to Hardcoded C2 with XOR-Encrypted Beacon Pattern
description: "Detects unsigned or ad-hoc-signed application binaries establishing\
\ HTTPS connections to external domains on port 443, particularly from non-standard\
\ application paths \u2014 consistent with AppleJeus CrashReporter C2 communication\
\ pattern."
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
category: network_connection
product: macos
detection:
selection:
DestinationPort: 443
Protocol: https
Image|contains:
- /private/var/
- /tmp/
- /Users/
Image|endswith:
- Reporter
- CrashReporter
filter_legitimate_apple:
DestinationHostname|contains:
- apple.com
- icloud.com
- mzstatic.com
condition: selection and not filter_legitimate_apple
falsepositives:
- Legitimate third-party applications installed in user directories contacting remote
services
- macOS system utilities communicating over HTTPS
level: medium
id: 22393508-2550-5284-bd62-0776b72082b5
status: experimental
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x49.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free