XagentOSX reuses leaked HackingTeam injection code
Analysis of APT28's XagentOSX/Komplex.B macOS malware shows its unused code-injection routine was copied nearly verbatim from HackingTeam's leaked RCS implant source code.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Researchers analyzed a Mac malware sample (XagentOSX, also called Komplex.B) linked to APT28/Sofacy, following earlier writeups from BitDefender and Palo Alto Networks Unit42 that tied the sample to the Komplex downloader. While the binary contains a class called InjectApp implementing macOS process-injection via AppleScript/SBApplication AppleEvents, deeper analysis found that this injection code is never actually invoked by any code path in the malware, and had to be triggered manually by patching the instruction pointer in a debugger.
Comparing the disassembled injection logic against HackingTeam's publicly leaked RCS macOS implant source code (from the 2015 HackingTeam breach) revealed matching method names, matching parameter lists, an identical hardcoded blacklist array (appBListArray) with the same values, and even the same logic bugs (a broken nil-check in isInjectable) and leftover dead code (a pointless lock/unlock and a string comparison that can never be true) stemming from incomplete removal of HackingTeam's TaskManager class. These artifacts strongly indicate the XagentOSX authors directly copy-pasted HackingTeam's injection code rather than independently reimplementing the same technique.
The finding suggests a code-sharing or reuse relationship between HackingTeam's leaked commercial spyware and a Russian-attributed espionage toolset, though the analyst notes attribution of motive (purchase vs. use of leaked source) cannot be confirmed. The injection capability itself was not active in the sample studied, so it represents a latent/unused feature rather than an in-the-wild technique.
Mentioned in this report
Detection guidance
Suspicious AppleScript Process Injection via SBApplication
A behavioural hunt for the technique in general.
Detects process injection attempts using AppleScript/SBApplication AppleEvents with characteristic class and method patterns matching known injection frameworks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious AppleScript Process Injection via SBApplication
description: Detects macOS process injection via AppleScript/SBApplication AppleEvents,
characteristic of spyware frameworks. Monitors for InjectApp class instantiation
or typical injection method calls.
tags:
- attack.execution
- attack.t1055
logsource:
category: process_creation
product: macos
detection:
selection_applescript_inject:
CommandLine|contains:
- InjectApp
- isInjectable
- appBListArray
Image|endswith:
- /osascript
- /AppleScript
selection_sbapplication:
CommandLine|contains: SBApplication
Image|endswith:
- /osascript
- /AppleScript
filter_admin:
User|contains:
- root
- admin
condition: (selection_applescript_inject or selection_sbapplication) and not filter_admin
falsepositives:
- Legitimate automation scripts using AppleScript for inter-process communication
- System administration tools leveraging SBApplication for macOS automation
level: high
id: 3e7911da-fa2a-51e9-8dd6-5d0871a5f59e
status: experimental
author: Vorant
macOS Binary with Hardcoded Process Injection Blacklist
A behavioural hunt for the technique in general.
Detects execution of macOS binaries containing hardcoded application blacklist arrays characteristic of process injection filtering logic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Binary with Hardcoded Process Injection Blacklist
description: Detects suspicious macOS binaries with embedded hardcoded blacklist arrays
used to filter injection targets, a pattern seen in advanced spyware injection frameworks.
tags:
- attack.execution
- attack.t1055
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- /XagentOSX
- /Komplex
CommandLine|contains:
- appBListArray
- blacklist
filter_legitimate:
ParentImage|endswith:
- /Finder
- /Dock
- /Launchpad
condition: selection and not filter_legitimate
falsepositives:
- Custom endpoint security software implementing target filtering
- Legitimate process isolation utilities with embedded configuration
level: medium
id: 3f15a7d2-e5ae-5208-b424-3fcd2bf4adb1
status: experimental
author: Vorant
APT28/Sofacy Toolset Download and Execution Chain
A behavioural hunt for the technique in general.
Detects download and execution patterns of known APT28/Sofacy malware families like XagentOSX or Komplex downloader on macOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: APT28/Sofacy Toolset Download and Execution Chain
description: Detects ingress tool transfer and execution of known APT28/Sofacy macOS
malware families (XagentOSX, Komplex), focusing on download-to-execution behaviour
patterns.
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: macos
detection:
selection_xagent:
Image|endswith:
- /XagentOSX
- /Komplex.B
- /komplex
selection_download:
CommandLine|contains:
- curl
- wget
- python
ParentImage|contains:
- /Library/
- /tmp/
- /var/tmp/
filter_admin:
User: root
condition: (selection_xagent or selection_download) and not filter_admin
falsepositives:
- Software package installers downloading and executing binaries to /tmp
- Legitimate system tools updating from remote repositories
level: high
id: e3cc58e9-7bac-5d4d-855f-af8729d8c086
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x18.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs