Threat video1:00
BeaverTail & LightSpy 2024 Mac Malware: Detection & IOCs
Objective-See's 2024 review covers macOS stealers, backdoors and DPRK implants, with 9 detection rules, 28 IOCs and a free Splunk SPL rule.
Read the full threat intel for BeaverTail & LightSpy 2024 Mac Malware: Detection & IOCs →
Chapters
- 0:00The hook12 new macOS malware families in 2024.
- 0:04The storyStealers dominated 2024 macOS malware.
- 0:11Attack pathLab-reproduced: trojanized apps lured users to run them.
- 0:27AttributionAttributed to DPRK.
- 0:32Indicators of compromise23 indicators to hunt: 4 IPs, 5 domains and 4 URLs, and more.
- 0:39MITRE ATT&CK techniques19 ATT&CK techniques, from initial access to impact.
- 0:43Remediation3 steps now: Block the listed C2 IPs and domains at the perimeter.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0012 new macOS malware families in 2024.
0:05Stealers dominated 2024 macOS malware.
0:08Fake applications drove infection.
0:12Lab-reproduced: trojanized apps lured users to run them.
0:16They stole credentials, keychains and wallets.
0:19Persisted via Launch Agents and startup files.
0:22Then beaconing to command and control servers.
0:28Attributed to DPRK. Confidence: medium.
0:3223 indicators to hunt: 4 IPs, 5 domains and 4 URLs, and more.
0:3919 ATT&CK techniques, from initial access to impact.
0:443 steps now: Block the listed C2 IPs and domains at the perimeter.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.