North Korea’s Safari Campaign Delivers RATs

Summary

The article outlines a new macOS malware framework called Mach-O Man that has been linked to the Lazarus Group’s Famous Chollima unit. The malware is distributed through compromised Telegram accounts and fake meeting invitations that persuade targets to run a ClickFix command on their devices. The toolkit includes several Mach-O binaries designed to gather host details, maintain persistence, and steal credentials and browser data, with exfiltration occurring through Telegram. The campaign appears focused on cryptocurrency exchanges and other organizations in the financial sector.

Investigation

Researchers identified a staging binary named teamsSDK.bin that was downloaded and executed through a malicious command sequence. Additional components, including D1yCPUyk.bin, minst2.bin, and macrasv2, were then used to enumerate the system, create a LaunchAgent for persistence, and harvest browser extensions, keychain data, and cookies. Command-and-control communication relied on a Go-based HTTP server that exposed an unauthenticated /info endpoint and leaked a Telegram Bot API token. Investigators also found remote-access services such as RDP, WinRM, and Chrome Remote Desktop exposed on the C2 host.

Mitigation

Users should avoid interacting with unsolicited meeting links and confirm the legitimacy of any terminal commands suggested during unexpected conversations. Organizations should monitor for unauthorized LaunchAgents, require trusted code signing for macOS binaries, and restrict execution of unknown files. Network defenses should block outbound connections to suspicious Go-based HTTP servers and flag traffic using the Go-http-client user agent. Telegram bot tokens should be protected from exposure, and remote desktop services should be locked down with least-privilege access controls.

Response

Security teams should detect the execution of unknown .bin files and monitor for creation of LaunchAgents named com.onedrive.launcher. Alerts should also be triggered on outbound connections to suspicious infrastructure using the Go-http-client user agent, as well as repeated POST requests to /info endpoints. Defenders should watch for unexpected Telegram API activity tied to unfamiliar bot tokens. Full host forensics should be conducted to identify and remove all malicious binaries, followed by credential resets for any accounts that may have been compromised.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (T1546.006 / T1587.001) designed to trigger the detection rule. The commands reflect a realistic “living‑off‑the‑land” deployment of the Mach‑O Man binaries.

• Attack Narrative & Commands:

  1. An attacker who has already gained a foothold on the macOS host copies the four Mach‑O Man binaries from a staging location (/tmp/stage) to a writable directory (/usr/local/bin).
  2. The binaries are made executable and launched sequentially to mimic the kit’s initialisation, reconnaissance, persistence, and credential‑theft phases.
  3. Persistence is achieved by writing a launch daemon plist that points to minst2.bin.

  # Step 1 – Stage the binaries (simulated by copying from a test assets folder)
  mkdir -p /usr/local/bin/macho
  cp ./assets/teamsSDK.bin /usr/local/bin/macho/
  cp ./assets/D1YrHRTg.bin /usr/local/bin/macho/
  cp ./assets/minst2.bin   /usr/local/bin/macho/
  cp ./assets/macrasv2    /usr/local/bin/macho/
  
  # Step 2 – Make them executable
  chmod +x /usr/local/bin/macho/*.bin
  
  # Step 3 – Execute the stager and reconnaissance binaries
  /usr/local/bin/macho/teamsSDK.bin &
  /usr/local/bin/macho/D1YrHRTg.bin &
  
  # Step 4 – Install persistence (launch daemon) for minst2.bin
  cat <<'EOF' > /Library/LaunchDaemons/com.macho.minst2.plist
  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
  <dict>
      <key>Label</key><string>com.macho.minst2</string>
      <key>ProgramArguments</key>
      <array>
          <string>/usr/local/bin/macho/minst2.bin</string>
      </array>
      <key>RunAtLoad</key><true/>
  </dict>
  </plist>
  EOF
  sudo launchctl load -w /Library/LaunchDaemons/com.macho.minst2.plist
  
  # Step 5 – Execute the credential‑theft/exfil component
  /usr/local/bin/macho/macrasv2 &

• Regression Test Script: (self‑contained bash script that reproduces the above steps)

  #!/usr/bin/env bash
  set -euo pipefail
  
  # --- VARIABLES -------------------------------------------------
  BIN_DIR="/usr/local/bin/macho"
  ASSET_DIR="$(pwd)/assets"
  PLIST="/Library/LaunchDaemons/com.macho.minst2.plist"
  
  # --- PRE‑CHECK -------------------------------------------------
  if [[ $(id -u) -ne 0 ]]; then
    echo "Script requires root to install launch daemon. Re‑run with sudo."
    exit 1
  fi
  
  # --- DEPLOY BINARIES -------------------------------------------
  mkdir -p "$BIN_DIR"
  for bin in teamsSDK.bin D1YrHRTg.bin minst2.bin macrasv2; do
    cp "$ASSET_DIR/$bin" "$BIN_DIR/$bin"
    chmod +x "$BIN_DIR/$bin"
  done
  
  # --- EXECUTE STAGER & RECON ------------------------------------
  "$BIN_DIR/teamsSDK.bin" &
  "$BIN_DIR/D1YrHRTg.bin" &
  
  # --- PERSISTENCE (launch daemon) -------------------------------
  cat <<'EOF' > "$PLIST"
  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
  <dict>
      <key>Label</key><string>com.macho.minst2</string>
      <key>ProgramArguments</key>
      <array>
          <string>/usr/local/bin/macho/minst2.bin</string>
      </array>
      <key>RunAtLoad</key><true/>
  </dict>
  </plist>
  EOF
  launchctl load -w "$PLIST"
  
  # --- EXECUTE CREDENTIAL THEFT COMPONENT -----------------------
  "$BIN_DIR/macrasv2" &
  
  echo "Simulation executed – wait a few seconds for telemetry to appear."

• Cleanup Commands:

  #!/usr/bin/env bash
  set -euo pipefail
  
  BIN_DIR="/usr/local/bin/macho"
  PLIST="/Library/LaunchDaemons/com.macho.minst2.plist"
  
  # Unload launch daemon
  if [[ -f "$PLIST" ]]; then
    sudo launchctl unload -w "$PLIST"
    sudo rm -f "$PLIST"
  fi
  
  # Kill any lingering malicious processes
  pkill -f teamsSDK.bin || true
  pkill -f D1YrHRTg.bin || true
  pkill -f minst2.bin   || true
  pkill -f macrasv2    || true
  
  # Remove binaries
  sudo rm -rf "$BIN_DIR"
  
  echo "Cleanup complete."