VORANT. Threat Intelligence Sign in Get the full feed

SpectralBlur macOS backdoor tied to DPRK's TA444

routine threat financial-services

Researchers detailed SpectralBlur, a macOS backdoor linked to DPRK-affiliated TA444/BlueNoroff, that mirrors capabilities seen in the KandyKorn malware family.

Objective-See performed a deep technical triage of SpectralBlur, a macOS backdoor first flagged publicly by researcher Greg Lesnewich in early January 2024. The malware, an unsigned x86_64 Mach-O binary observed under filenames .macshare and mac.jpg, supports typical backdoor functionality including file upload/download, shell command execution via a pseudo-terminal, configuration management, file deletion (with secure overwrite), sleep/hibernate, and process restart/kill, all driven by commands received from a C2 server over an encrypted channel using a custom stream cipher (xcrypt).

Analysis found the sample uses several anti-analysis techniques such as forking, spawning pseudo-terminals via posix_openpt/grantpt, and multiple process forks/execs, likely to complicate detection and dynamic analysis. The sample was first submitted to VirusTotal in August 2023 from Colombia and was undetected by any AV engine at that time, with only ESET flagging it after a rescan months later. Researchers noted structural and functional overlaps with KandyKorn, a known DPRK-linked macOS malware family previously documented by Elastic, though differences suggest SpectralBlur may have been developed by a separate team with similar operational requirements.

Attribution ties SpectralBlur to TA444, also known as BlueNoroff, a North Korean state-sponsored threat actor historically associated with cryptocurrency theft and financial-sector targeting. No specific victims or campaign name were disclosed in this technical writeup; the focus is on malware capability analysis and family linkage rather than active in-the-wild targeting details.

Mentioned in this report

Threat actors TA444
Malware KANDYKORNSpectralBlur

Detection guidance

macOS Process Spawning Pseudo-Terminal via posix_openpt

ATT&CK T1059.004

Detects suspicious processes calling posix_openpt/grantpt to spawn pseudo-terminals, commonly used by backdoors for shell command execution and process hiding. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Spawning Pseudo-Terminal via posix_openpt
description: Detects processes invoking posix_openpt and grantpt system calls to allocate
  pseudo-terminals, a technique used by backdoors to execute shell commands and evade
  detection via process isolation.
tags:
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - posix_openpt
    - grantpt
  filter_legitimate:
    Image|endswith:
    - /Terminal
    - /iTerm
    - /tmux
  condition: selection and not filter_legitimate
falsepositives:
- Legitimate terminal emulators or multiplexers allocating pseudo-terminals
- System utilities managing TTY allocation
level: medium
id: 3b96adca-49cc-5539-b7db-72f5cb8f5861
status: experimental
author: Vorant

macOS Process Forking and Child Process Execution Chain

ATT&CK T1059.004

Detects suspicious patterns of parent processes spawning multiple child processes via fork/exec, indicative of backdoor anti-analysis obfuscation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Forking and Child Process Execution Chain
description: Detects processes creating multiple forked child processes in rapid succession,
  a common anti-analysis technique used by backdoors to obscure execution and complicate
  forensic analysis.
tags:
- attack.defense-evasion
- attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith:
    - .macshare
    - mac.jpg
    EventType: CreateProcess
  filter_system:
    ParentImage|endswith:
    - /bash
    - /sh
    - /zsh
    - /launchd
  condition: selection and not filter_system
falsepositives:
- Legitimate parallel build systems (make -j, xcodebuild)
- Package managers spawning worker processes
level: high
id: e3cf41b7-ce1a-5169-86a8-596bcb446047
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x78.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free