LightSpy: Implant for macOS

MITRE Techniques

• [T1203] Exploitation for Client Execution – The threat actor group used two publicly available exploits (CVE-2018-4233, CVE-2018-4404) to deliver implants for macOS. “The Threat actor group used two publicly available exploits (CVE-2018-4233, CVE-2018-4404) to deliver implants for macOS.”
• [T1105] Ingress Tool Transfer – The intermediate downloader 20004312341.png is actually a MachO x86_64 binary, downloaded as part of the infection chain. “This ‘20004312341.png’ is actually MachO x86_64 binary executable file.”
• [T1543.003] Create or Modify System Process: Launch Daemons – The downloader script decrypts and unpacks mac.zip, then uses launchd to persist, causing the “update” binary to start at each boot. “archive persistence on the system using launchecrtl. Starting from that moment ‘update’ binary will start during each system boot-up.”
• [T1140] Deobfuscate/Decode Files or Information – The decryption uses XOR and mirrors the Android decryption. “The decryption will be done using XOR, the decryption algorithm is identical to LightSpy Android plugin decryption.”
• [T1059.004] Unix Shell – The final Stage 2 uses a plain Bash script to download and execute further payloads. “The resulting script is a plain Bash script that will download three more files using curl utility.”
• [T1046] Network Service Discovery / [T1018] System Network Configuration Discovery – macOS plugin LanDevices discovers networked devices in the local environment. “This plugin is based on SimplePing framework which is used for pinging the host and checking the availability of the corresponding device.”
• [T1057] Process Discovery / [T1518] Software Discovery – Softlist exfiltrates installed applications and running processes. “Exfiltrate the list of installed applications” and “Exfiltrate the list of currently running processes”
• [T1059.001] Command and Scripting Interpreter: macOS/Unix Shell – ShellCommand plugin provides a remote shell capability. “Remote shell plugin”
• [T1041] Exfiltration Over C2 Channel – Data and command results are sent as JSON objects over WebSocket via SendCommandOver. “The results of gathering data as well as command execution results will be JSON objects that will be sent using SendCommandOver function.”
• [T1555.003] Credentials from Password Stores: Keychain – Keychain plugin exfiltrates passwords, certificates, and keys from Keychain. “This plugin is responsible for the exfiltration of passwords, certificates, and keys from Keychain.”
• [T1049] System Network Connections Discovery / [T1046] Network Service Discovery – Wi-Fi plugin exfiltrates nearby networks and connection history using system data. “Wi-Fi nearby list and Wi-Fi connection history exfiltration plugin.”