FinSpy macOS variant uses kernel rootkit
Objective-See's triage of a newly disclosed macOS FinSpy sample reveals a fake app dropper chain, local privilege escalation exploits, and an unsigned kernel-mode rootkit for process hiding.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2015-5889 (weaponized); no exploitation in the wild is recorded.
Following Amnesty International's disclosure that FinFisher's FinSpy commercial spyware suite has previously undisclosed macOS and Linux variants, Objective-See performed a hands-on technical triage of the macOS sample (caglayan-macos.dmg). The malware disguises itself as an installer for a legitimate Turkish application (Çağlayan), using a bash script to launch a hidden backdoor installer (ARA0848.app) while a benign Adobe Air installer runs in the foreground to avoid raising suspicion.
The backdoor installer employs LLVM-based obfuscation, anti-debugging (ptrace denial), and VM-detection checks before attempting local privilege escalation via multiple exploits, including a known macOS <10.9/10 flaw and CVE-2015-5889. If exploitation fails, it falls back to prompting the user for admin credentials. Once root is obtained, it installs a persistent launch agent (logind.plist), a persistent implant (/private/etc/logind), and — notably — an unsigned kernel extension (logind.kext) that implements process-hiding rootkit functionality by unlinking target processes from the kernel's proc list. This kernel-mode capability is described as rare among public macOS malware samples. The kext is unsigned and thus non-functional on modern macOS versions enforcing kext signing, and the local privilege escalation exploits are patched in recent macOS releases, limiting the malware's practical impact to older/unpatched systems.
FinSpy has a documented history of use against human rights defenders, activists, journalists, and dissidents in countries including Bahrain, Ethiopia, Egypt, and the UAE. Objective-See notes their free tools (BlockBlock, KnockKnock, Process Monitor, File Monitor) can detect the malware's persistence and installation behavior without prior signature knowledge.
Mentioned in this report
Detection guidance
Suspicious Bash Script Launching Hidden Application Installer
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects bash executing a hidden .app bundle (ARA0848.app or similar) while a decoy installer runs in foreground — typical FinSpy delivery pattern on macOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Bash Script Launching Hidden Application Installer
description: Detects bash spawning a hidden .app bundle installer (matching the FinSpy
pattern of launching ARA0848.app disguised under a legitimate Turkish app installer)
while a benign process (e.g., Adobe Air) runs in the foreground to distract the
user.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|endswith: /bin/bash
Image|endswith: .app/Contents/MacOS/*
CommandLine|contains:
- ARA
- /Library
- /tmp
filter_legitimate_app_launch:
Image|endswith:
- /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
- /Applications/Safari.app/Contents/MacOS/Safari
condition: selection and not filter_legitimate_app_launch
falsepositives:
- Legitimate macOS app installers or update mechanisms spawning child .app processes
from bash scripts
- System automation tools launching applications via bash during software deployment
level: medium
id: b3bd5dc6-6627-5aa2-baf8-6db8d80f8dd1
status: experimental
author: Vorant
Unsigned Kernel Extension Installation Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects process attempting to load an unsigned kernel extension (logind.kext or similar) — FinSpy's kernel rootkit delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unsigned Kernel Extension Installation Attempt
description: Detects execution of kextload or kextutil with an unsigned .kext bundle,
or direct .kext installation attempts from non-standard paths. FinSpy loads an unsigned
logind.kext kernel extension to implement process-hiding rootkit functionality.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1014
logsource:
category: process_creation
product: macos
detection:
selection_kextload:
Image|endswith:
- /sbin/kextload
- /usr/sbin/kextutil
CommandLine|contains: .kext
selection_kext_paths:
Image|endswith: .kext/Contents/MacOS/*
CommandLine|contains:
- /private/etc/
- /tmp/
- /var/tmp/
filter_apple_kexts:
CommandLine|contains:
- /System/Library/Extensions/
- /Library/Extensions/Apple
condition: (selection_kextload or selection_kext_paths) and not filter_apple_kexts
falsepositives:
- Legitimate third-party security or virtualization software installing signed kernel
extensions
- System administration tools loading kernel extensions during maintenance
level: high
id: e0898b6d-7bfd-5a59-be98-1d2202d5c0e0
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x4F.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs