Researcher repurposes Lazarus macOS loader

A researcher reverse-engineered Lazarus Group's fileless macOS loader (OSX.AppleJeus.C/unioncryptoupdater) and showed how to hijack it to execute arbitrary in-memory payloads.

Objective-See's Patrick Wardle revisits a Lazarus Group macOS implant (internally 'macloader', tracked as OSX.AppleJeus.C, binary name unioncryptoupdater) previously analyzed for its fileless, in-memory payload execution capability. The malware persists via a LaunchDaemon and beacons to a hardcoded C2 (unioncrypto.vip) requesting second-stage payloads that are base64-decoded, AES-CBC decrypted (key derived from an MD5 hash of the victim's serial number), and loaded directly into memory via mmap and Apple's NSCreateObjectFileImageFromMemory/NSLinkModule APIs—code the author notes was lifted almost verbatim from Cylance's 2017 open-source 'osx_runbin' project.

Having fully reverse-engineered the C2 protocol, encryption scheme, and payload format, the author built a custom Python C2 server to emulate the expected responses, then patched the malware's binary to point to an attacker-controlled server and payload location. This allowed a benign 'Hello World' Mach-O binary to be encrypted, encoded, and successfully executed in memory on an infected test system, demonstrating that Lazarus's loader can be trivially repurposed by third parties to deliver arbitrary code while masquerading as Lazarus activity—complicating attribution and forensics.

The piece is primarily a technical/research writeup illustrating malware repurposing and macOS in-memory execution detection challenges (via Apple's Endpoint Security Framework, e.g., ES_EVENT_TYPE_NOTIFY_MMAP), rather than reporting a new active campaign. It reinforces that Lazarus continues to develop and deploy fileless macOS tooling, and highlights the difficulty of memory forensics on macOS given kernel extension deprecation.

Source reporting: https://objective-see.org/blog/blog_0x54.html