SpectralBlur macOS backdoor tied to DPRK's TA444
Researchers detailed SpectralBlur, a macOS backdoor linked to DPRK-affiliated TA444/BlueNoroff, that mirrors capabilities seen in the KandyKorn malware family.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Objective-See performed a deep technical triage of SpectralBlur, a macOS backdoor first flagged publicly by researcher Greg Lesnewich in early January 2024. The malware, an unsigned x86_64 Mach-O binary observed under filenames .macshare and mac.jpg, supports typical backdoor functionality including file upload/download, shell command execution via a pseudo-terminal, configuration management, file deletion (with secure overwrite), sleep/hibernate, and process restart/kill, all driven by commands received from a C2 server over an encrypted channel using a custom stream cipher (xcrypt).
Analysis found the sample uses several anti-analysis techniques such as forking, spawning pseudo-terminals via posix_openpt/grantpt, and multiple process forks/execs, likely to complicate detection and dynamic analysis. The sample was first submitted to VirusTotal in August 2023 from Colombia and was undetected by any AV engine at that time, with only ESET flagging it after a rescan months later. Researchers noted structural and functional overlaps with KandyKorn, a known DPRK-linked macOS malware family previously documented by Elastic, though differences suggest SpectralBlur may have been developed by a separate team with similar operational requirements.
Attribution ties SpectralBlur to TA444, also known as BlueNoroff, a North Korean state-sponsored threat actor historically associated with cryptocurrency theft and financial-sector targeting. No specific victims or campaign name were disclosed in this technical writeup; the focus is on malware capability analysis and family linkage rather than active in-the-wild targeting details.
Mentioned in this report
Detection guidance
macOS Process Spawning Pseudo-Terminal via posix_openpt
A behavioural hunt for the technique in general.
Detects suspicious processes calling posix_openpt/grantpt to spawn pseudo-terminals, commonly used by backdoors for shell command execution and process hiding. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Process Spawning Pseudo-Terminal via posix_openpt
description: Detects processes invoking posix_openpt and grantpt system calls to allocate
pseudo-terminals, a technique used by backdoors to execute shell commands and evade
detection via process isolation.
tags:
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains:
- posix_openpt
- grantpt
filter_legitimate:
Image|endswith:
- /Terminal
- /iTerm
- /tmux
condition: selection and not filter_legitimate
falsepositives:
- Legitimate terminal emulators or multiplexers allocating pseudo-terminals
- System utilities managing TTY allocation
level: medium
id: 3b96adca-49cc-5539-b7db-72f5cb8f5861
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x78.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs