Lazarus deploys new AppleJeus variant via JMTTrading
Lazarus Group used a fake crypto-trading firm, JMT Trading, to distribute a new macOS AppleJeus backdoor with full remote command execution.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Researcher Patrick Wardle analyzed a new macOS malware sample, distributed via a trojanized cryptocurrency trading application called "JMTTrader," hosted on a fake company website (jmttrading.org) and a GitHub release page. The infection chain closely mirrors Kaspersky's previously documented "Operation AppleJeus" campaign, in which Lazarus Group created a fake company ("Celas Trade Pro") to trick cryptocurrency exchange employees into installing malicious trading software. The JMTTrader.pkg installer drops a launch daemon (org.jmttrading.plist) and a persistent Mach-O binary (CrashReporter) that requires a specific command-line argument to execute — a known Lazarus anti-analysis technique.
Once running, the CrashReporter binary contacts a hardcoded C2 (beastgoc.com, resolving to 185.228.83.32) over HTTPS, sending XOR-encrypted beacons containing a random token, version, and PID. The malware supports commands including exit, file upload (up), and arbitrary shell command execution via popen, giving an attacker full remote control of infected macOS hosts. While architecturally and functionally distinct from the previously analyzed Qt-based Lazarus backdoor (different commands, no cross-platform code, no system-recon functions), multiple design similarities — the fake-company lure, unsigned/ad-hoc-signed installer package, launch daemon persistence pattern, and command-line-argument gating logic — strongly tie this sample to the same actor.
At time of analysis the sample was undetected by all VirusTotal engines, though behavior-based tools (BlockBlock, LuLu, Netiquette) readily flagged the persistence and C2 activity. The malware appears targeted at employees of cryptocurrency exchanges rather than the general public, consistent with Lazarus's financially-motivated targeting of crypto infrastructure.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x49.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs