FinSpy macOS variant uses kernel rootkit

Objective-See's triage of a newly disclosed macOS FinSpy sample reveals a fake app dropper chain, local privilege escalation exploits, and an unsigned kernel-mode rootkit for process hiding.

Following Amnesty International's disclosure that FinFisher's FinSpy commercial spyware suite has previously undisclosed macOS and Linux variants, Objective-See performed a hands-on technical triage of the macOS sample (caglayan-macos.dmg). The malware disguises itself as an installer for a legitimate Turkish application (Çağlayan), using a bash script to launch a hidden backdoor installer (ARA0848.app) while a benign Adobe Air installer runs in the foreground to avoid raising suspicion.

The backdoor installer employs LLVM-based obfuscation, anti-debugging (ptrace denial), and VM-detection checks before attempting local privilege escalation via multiple exploits, including a known macOS <10.9/10 flaw and CVE-2015-5889. If exploitation fails, it falls back to prompting the user for admin credentials. Once root is obtained, it installs a persistent launch agent (logind.plist), a persistent implant (/private/etc/logind), and — notably — an unsigned kernel extension (logind.kext) that implements process-hiding rootkit functionality by unlinking target processes from the kernel's proc list. This kernel-mode capability is described as rare among public macOS malware samples. The kext is unsigned and thus non-functional on modern macOS versions enforcing kext signing, and the local privilege escalation exploits are patched in recent macOS releases, limiting the malware's practical impact to older/unpatched systems.

FinSpy has a documented history of use against human rights defenders, activists, journalists, and dissidents in countries including Bahrain, Ethiopia, Egypt, and the UAE. Objective-See notes their free tools (BlockBlock, KnockKnock, Process Monitor, File Monitor) can detect the malware's persistence and installation behavior without prior signature knowledge.

title: Suspicious Bash Script Launching Hidden Application Installer
description: Detects bash spawning a hidden .app bundle installer (matching the FinSpy
  pattern of launching ARA0848.app disguised under a legitimate Turkish app installer)
  while a benign process (e.g., Adobe Air) runs in the foreground to distract the
  user.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /bin/bash
    Image|endswith: .app/Contents/MacOS/*
    CommandLine|contains:
    - ARA
    - /Library
    - /tmp
  filter_legitimate_app_launch:
    Image|endswith:
    - /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
    - /Applications/Safari.app/Contents/MacOS/Safari
  condition: selection and not filter_legitimate_app_launch
falsepositives:
- Legitimate macOS app installers or update mechanisms spawning child .app processes
  from bash scripts
- System automation tools launching applications via bash during software deployment
level: medium
id: b3bd5dc6-6627-5aa2-baf8-6db8d80f8dd1
status: experimental
author: Vorant

title: Launch Agent Installation for Rootkit Persistence
description: Detects creation or modification of logind.plist (or similar suspicious-named
  .plist) in standard macOS LaunchAgent directories. FinSpy installs logind.plist
  as a launch agent to maintain persistence for its kernel extension rootkit.
tags:
- attack.persistence
- attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
    - /Library/LaunchAgents/logind.plist
    - /Users/*/Library/LaunchAgents/logind.plist
    EventType:
    - Created
    - Modified
  filter_legitimate_system_updates:
    TargetFilename|contains: Apple
  condition: selection and not filter_legitimate_system_updates
falsepositives:
- Legitimate macOS security software installing custom launch agents
- System updates or maintenance tools modifying LaunchAgent directories
level: high
id: 73b5b8af-d0a3-5b60-ba89-0b1c55b68310
status: experimental
author: Vorant

title: Unsigned Kernel Extension Installation Attempt
description: Detects execution of kextload or kextutil with an unsigned .kext bundle,
  or direct .kext installation attempts from non-standard paths. FinSpy loads an unsigned
  logind.kext kernel extension to implement process-hiding rootkit functionality.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1014
logsource:
  category: process_creation
  product: macos
detection:
  selection_kextload:
    Image|endswith:
    - /sbin/kextload
    - /usr/sbin/kextutil
    CommandLine|contains: .kext
  selection_kext_paths:
    Image|endswith: .kext/Contents/MacOS/*
    CommandLine|contains:
    - /private/etc/
    - /tmp/
    - /var/tmp/
  filter_apple_kexts:
    CommandLine|contains:
    - /System/Library/Extensions/
    - /Library/Extensions/Apple
  condition: (selection_kextload or selection_kext_paths) and not filter_apple_kexts
falsepositives:
- Legitimate third-party security or virtualization software installing signed kernel
  extensions
- System administration tools loading kernel extensions during maintenance
level: high
id: e0898b6d-7bfd-5a59-be98-1d2202d5c0e0
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x4F.html