VORANT. Threat Intelligence Sign in Get the full feed

XagentOSX reuses leaked HackingTeam injection code

routine threat

Analysis of APT28's XagentOSX/Komplex.B macOS malware shows its unused code-injection routine was copied nearly verbatim from HackingTeam's leaked RCS implant source code.

Researchers analyzed a Mac malware sample (XagentOSX, also called Komplex.B) linked to APT28/Sofacy, following earlier writeups from BitDefender and Palo Alto Networks Unit42 that tied the sample to the Komplex downloader. While the binary contains a class called InjectApp implementing macOS process-injection via AppleScript/SBApplication AppleEvents, deeper analysis found that this injection code is never actually invoked by any code path in the malware, and had to be triggered manually by patching the instruction pointer in a debugger.

Comparing the disassembled injection logic against HackingTeam's publicly leaked RCS macOS implant source code (from the 2015 HackingTeam breach) revealed matching method names, matching parameter lists, an identical hardcoded blacklist array (appBListArray) with the same values, and even the same logic bugs (a broken nil-check in isInjectable) and leftover dead code (a pointless lock/unlock and a string comparison that can never be true) stemming from incomplete removal of HackingTeam's TaskManager class. These artifacts strongly indicate the XagentOSX authors directly copy-pasted HackingTeam's injection code rather than independently reimplementing the same technique.

The finding suggests a code-sharing or reuse relationship between HackingTeam's leaked commercial spyware and a Russian-attributed espionage toolset, though the analyst notes attribution of motive (purchase vs. use of leaked source) cannot be confirmed. The injection capability itself was not active in the sample studied, so it represents a latent/unused feature rather than an in-the-wild technique.

Mentioned in this report

Threat actors APT28
Malware HackingTeam RCSKomplexXAgentOSX

Detection guidance

Suspicious AppleScript Process Injection via SBApplication

ATT&CK T1055

Detects process injection attempts using AppleScript/SBApplication AppleEvents with characteristic class and method patterns matching known injection frameworks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious AppleScript Process Injection via SBApplication
description: Detects macOS process injection via AppleScript/SBApplication AppleEvents,
  characteristic of spyware frameworks. Monitors for InjectApp class instantiation
  or typical injection method calls.
tags:
- attack.execution
- attack.t1055
logsource:
  category: process_creation
  product: macos
detection:
  selection_applescript_inject:
    CommandLine|contains:
    - InjectApp
    - isInjectable
    - appBListArray
    Image|endswith:
    - /osascript
    - /AppleScript
  selection_sbapplication:
    CommandLine|contains: SBApplication
    Image|endswith:
    - /osascript
    - /AppleScript
  filter_admin:
    User|contains:
    - root
    - admin
  condition: (selection_applescript_inject or selection_sbapplication) and not filter_admin
falsepositives:
- Legitimate automation scripts using AppleScript for inter-process communication
- System administration tools leveraging SBApplication for macOS automation
level: high
id: 3e7911da-fa2a-51e9-8dd6-5d0871a5f59e
status: experimental
author: Vorant

macOS Binary with Hardcoded Process Injection Blacklist

ATT&CK T1055

Detects execution of macOS binaries containing hardcoded application blacklist arrays characteristic of process injection filtering logic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Binary with Hardcoded Process Injection Blacklist
description: Detects suspicious macOS binaries with embedded hardcoded blacklist arrays
  used to filter injection targets, a pattern seen in advanced spyware injection frameworks.
tags:
- attack.execution
- attack.t1055
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
    - /XagentOSX
    - /Komplex
    CommandLine|contains:
    - appBListArray
    - blacklist
  filter_legitimate:
    ParentImage|endswith:
    - /Finder
    - /Dock
    - /Launchpad
  condition: selection and not filter_legitimate
falsepositives:
- Custom endpoint security software implementing target filtering
- Legitimate process isolation utilities with embedded configuration
level: medium
id: 3f15a7d2-e5ae-5208-b424-3fcd2bf4adb1
status: experimental
author: Vorant

APT28/Sofacy Toolset Download and Execution Chain

ATT&CK T1105

Detects download and execution patterns of known APT28/Sofacy malware families like XagentOSX or Komplex downloader on macOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: APT28/Sofacy Toolset Download and Execution Chain
description: Detects ingress tool transfer and execution of known APT28/Sofacy macOS
  malware families (XagentOSX, Komplex), focusing on download-to-execution behaviour
  patterns.
tags:
- attack.command-and-control
- attack.t1105
logsource:
  category: process_creation
  product: macos
detection:
  selection_xagent:
    Image|endswith:
    - /XagentOSX
    - /Komplex.B
    - /komplex
  selection_download:
    CommandLine|contains:
    - curl
    - wget
    - python
    ParentImage|contains:
    - /Library/
    - /tmp/
    - /var/tmp/
  filter_admin:
    User: root
  condition: (selection_xagent or selection_download) and not filter_admin
falsepositives:
- Software package installers downloading and executing binaries to /tmp
- Legitimate system tools updating from remote repositories
level: high
id: e3cc58e9-7bac-5d4d-855f-af8729d8c086
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x18.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free