Cybersecurity researchers have recently brought to light a newly discovered threat to Apple macOS, identified as SpectralBlur. This backdoor shares a connection with a known malware family attributed to North Korean threat actors. SpectralBlur, described as a moderately capable backdoor, exhibits functionalities such as file uploads and downloads, shell execution, configuration updates, file deletion, hibernation, and sleep, all of which are directed by commands from a command-and-control server.

Greg Lesnewich, a security researcher, emphasized SpectralBlur's similarities to KANDYKORN (also known as SockRacket), an advanced implant serving as a remote access trojan with the ability to take control of compromised hosts. Notably, KANDYKORN is associated with the Lazarus subgroup's BlueNoroff campaign, leading to the deployment of the RustBucket backdoor and the ObjCShellz payload.

The trend of North Korean threat actors targeting macOS, particularly within industries like cryptocurrency and blockchain, has been on the rise. According to Lesnewich, "TA444 keeps running fast and furious with these new macOS malware families." Security researcher Patrick Wardle delves into SpectralBlur's inner workings, highlighting that the Mach-O binary was uploaded to the VirusTotal malware scanning service in August 2023 from Colombia.

SpectralBlur stands out due to its attempts to impede analysis and evade detection, utilizing grantpt to set up a pseudo-terminal for executing shell commands received from the command-and-control server. The complexity and sophistication of these evasion techniques suggest a concerted effort to maintain covert operations.

This discovery comes in the context of a broader cybersecurity landscape, revealing a significant increase in macOS-targeted threats. In 2023 alone, 21 new malware families, ranging from ransomware to information stealers, remote access trojans, and nation-state-backed malware, were identified—marking an escalation from the 13 families detected in 2022. Patrick Wardle anticipates that the growth and popularity of macOS, especially in enterprise environments, will likely lead to an upsurge in new macOS malware throughout 2024. 

Source: https://thehackernews.com/2024/01/spectralblur-new-macos-backdoor-threat.html