Threat reportMalwareTL-2026-4894
DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)
DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff) (TL-2026-4894), also tracked as SpectralBlur, is a high-severity malware campaign, first published 2026-10-31. It is attributed to TA444 (North Korea) with medium confidence, affects Apple macOS, maps to 7 MITRE ATT&CK techniques (T1005, T1027, T1059.004), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 2TA444
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-4894
- Threat ID
- TL-2026-4894
- Also known as
- SpectralBlur
- Severity
- HIGH
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- TA444, APT38
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, blockchain, finance
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)
Malware and tooling: KANDYKORN, ObjCShellz, RustBucket (OS X), SpectralBlur (ELF), XCrypt Ransomware
How DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff) works
SpectralBlur is a moderately capable macOS Mach-O backdoor attributed to North Korea and linked to TA444 / BlueNoroff, overlapping with the KANDYKORN family. It supports file upload/download, shell execution through a pseudo-terminal, configuration updates, secure file deletion, hibernation and sleep, and reads an encrypted configuration from a .d file.
SpectralBlur is an unsigned x86_64 Mach-O backdoor first seen when a sample was submitted to VirusTotal from Colombia on 2023-08-16, where it initially had no detections. Greg Lesnewich (Proofpoint) triaged it in his 100DaysofYARA series on 2024-01-03, and Patrick Wardle (Objective-See) published a full analysis on 2024-01-04, 'Analyzing DPRK's SpectralBlur'. The sample was observed at /Users/Shared/.macshare and also named mac.jpg. The leading dot hides the binary from default Finder and ls views.
The backdoor loads an encrypted configuration from a file whose name is the binary path with a .d suffix (for example macshare.d). Both the configuration and the C2 network traffic are protected with a custom stream cipher implemented in an 'xcrypt' function. The key is derived from a random 64-bit value combined with a timestamp. At runtime the malware forks multiple child processes and opens a pseudo-terminal with posix_openpt/grantpt, which Objective-See assesses complicates dynamic analysis and perhaps detection.
The malware dispatches 15 command handlers: 0x1 proc_none, 0x2 proc_shell (run commands via the pseudo-terminal), 0x3 proc_dir (directory listing), 0x4 proc_upload, 0x5 proc_upload_content, 0x6 proc_download, 0x7 proc_rmfile (overwrite the file with zeros, then delete), 0x8 proc_testconn, 0x9 proc_getcfg, 0xa proc_setcfg, 0xb proc_hibernate, 0xc proc_sleep, 0xd proc_die, 0xe proc_stop and 0xf proc_restart. The source analysis does not identify the infection vector, the C2 address, or any in-the-wild victims.
Attribution rests on overlap with KANDYKORN (SockRacket), the macOS RAT Elastic Security Labs attributed to DPRK/Lazarus in November 2023, and on Proofpoint's Lesnewich assessing that TA444 debuted SpectralBlur in August 2023. TA444 is also tracked as BlueNoroff, APT38, Stardust Chollima, BlackAlicanto, Coperenicum and Sapphire Sleet, and has deployed RustBucket and ObjCShellz against macOS. Objective-See cautions that the similarities may reflect 'families developed by different folks with the same sort of requirements', so attribution confidence is MEDIUM. The network IOCs in this record belong to the related KANDYKORN intrusion set (Elastic REF7001), not to a confirmed SpectralBlur campaign. BeaconBeagle returned no match (HTTP 404) for 192.119.64.43 or 23.254.226.90.
MITRE ATT&CK techniques used in TL-2026-4894
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1564.001 Hidden Files and Directories
Execution
T1059.004 Unix Shell; T1106 Native API
Command and Control
Affected products and versions in DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)
- Apple — macOS
Vulnerable versions: macOS systems executing unsigned x86_64 Mach-O binaries
Remediation for DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)
Immediate actions
- Hunt macOS endpoints for hidden files named .macshare or mac.jpg, especially under /Users/Shared/
- Search for a companion configuration file named after a binary with a .d suffix, such as macshare.d
- Scan for SHA-1 06c8c84fb0a85bdf3520608b0a5c910b77e3b8c1 and SHA-256 6f3e849ee0fe7a6453bd0408f0537fa894b17fc55bc9d1729ae035596f5c9220
- Block the related KANDYKORN infrastructure (tp-globa.xyz, 192.119.64.43, 23.254.226.90) at the perimeter
Workarounds
- Enforce Gatekeeper and notarization requirements and restrict execution from world-writable shared directories
Longer-term hardening
- Deploy macOS EDR with behavioral detection for unsigned binaries in /Users/Shared/ spawning shells through pseudo-terminals
- Alert on unsigned Mach-O binaries executing from /Users/Shared/
- Train cryptocurrency and blockchain staff on unsolicited software-sharing approaches on Discord and similar platforms
Timeline of DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)
- Elastic traces the related KANDYKORN intrusion set (DPRK/Lazarus overlap) back to approximately April 2023 (month-level date)
- SpectralBlur Mach-O sample (SHA-1 06c8c84f...) submitted to VirusTotal from Colombia with no initial detections
- Elastic Security Labs publishes the KANDYKORN analysis attributing the macOS RAT to DPRK/Lazarus
- Greg Lesnewich (Proofpoint) triages the sample in 100DaysofYARA - SpectralBlur and links it to TA444
- Objective-See publishes 'Analyzing DPRK's SpectralBlur', covering the 15 command handlers, the .d config and the custom stream cipher
- The Hacker News and other outlets report SpectralBlur as a new macOS backdoor overlapping KANDYKORN and linked to BlueNoroff / TA444
Sources cited for DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)
Detection coverage for TL-2026-4894
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4894 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.