Researcher repurposes Lazarus macOS loader
A researcher reverse-engineered Lazarus Group's fileless macOS loader (OSX.AppleJeus.C/unioncryptoupdater) and showed how to hijack it to execute arbitrary in-memory payloads.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Objective-See's Patrick Wardle revisits a Lazarus Group macOS implant (internally 'macloader', tracked as OSX.AppleJeus.C, binary name unioncryptoupdater) previously analyzed for its fileless, in-memory payload execution capability. The malware persists via a LaunchDaemon and beacons to a hardcoded C2 (unioncrypto.vip) requesting second-stage payloads that are base64-decoded, AES-CBC decrypted (key derived from an MD5 hash of the victim's serial number), and loaded directly into memory via mmap and Apple's NSCreateObjectFileImageFromMemory/NSLinkModule APIs—code the author notes was lifted almost verbatim from Cylance's 2017 open-source 'osx_runbin' project.
Having fully reverse-engineered the C2 protocol, encryption scheme, and payload format, the author built a custom Python C2 server to emulate the expected responses, then patched the malware's binary to point to an attacker-controlled server and payload location. This allowed a benign 'Hello World' Mach-O binary to be encrypted, encoded, and successfully executed in memory on an infected test system, demonstrating that Lazarus's loader can be trivially repurposed by third parties to deliver arbitrary code while masquerading as Lazarus activity—complicating attribution and forensics.
The piece is primarily a technical/research writeup illustrating malware repurposing and macOS in-memory execution detection challenges (via Apple's Endpoint Security Framework, e.g., ES_EVENT_TYPE_NOTIFY_MMAP), rather than reporting a new active campaign. It reinforces that Lazarus continues to develop and deploy fileless macOS tooling, and highlights the difficulty of memory forensics on macOS given kernel extension deprecation.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x54.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs