Objective-See dissects Lazarus NukeSped macOS backdoor
Objective-See's deep dive into a CISA-flagged Lazarus campaign shows a trojanized Electron crypto app dropping the NukeSped/Manuscrypt macOS backdoor.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This post expands on an April CISA advisory attributing a campaign against blockchain and cryptocurrency firms to North Korea's Lazarus Group (APT38), analyzing a specific macOS sample distributed as a trojanized Electron application named "Esilet." The unsigned app, delivered via a disk image, ships with an unpacked asar archive containing JavaScript that silently checks a hardcoded update URL, downloads a second-stage payload, and executes it — a pattern CISA has dubbed TraderTraitor.
The downloaded second-stage binary is a NukeSped (aka Manuscrypt) backdoor. Static and dynamic analysis show it persists via a LaunchAgent plist, beacons to hardcoded C2 domains over HTTP using libcurl, and supports a tasking switch-statement allowing remote system surveying (sw_vers, network config), arbitrary shell command execution via /bin/bash, and file read/write/exfiltration capabilities. Observed C2 infrastructure (vinoymas.ch, sche-eg.org, infodigitalnew.com) appeared offline at time of analysis.
The author confirms that Objective-See's free tools (KnockKnock, BlockBlock, LuLu) detect the malware's persistence and C2 network activity, framing the piece as both threat research and a validation of heuristic-based detection against a known nation-state toolset targeting the cryptocurrency sector.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x6E.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs