# DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)

> SpectralBlur is a moderately capable macOS Mach-O backdoor attributed to North Korea and linked to TA444 / BlueNoroff, overlapping with the KANDYKORN family. It supports file upload/download, shell execution through a pseudo-terminal, configuration updates, secure file deletion, hibernation and sleep, and reads an encrypted configuration from a .d file.

- **Published:** 2026-10-31T09:25:45Z
- **Last reviewed:** 2026-10-31T09:25:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4894
- **ID:** TL-2026-4894
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** TA444 (North Korea)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SpectralBlur is an unsigned x86_64 Mach-O backdoor first seen when a sample was submitted to VirusTotal from Colombia on 2023-08-16, where it initially had no detections. Greg Lesnewich (Proofpoint) triaged it in his 100DaysofYARA series on 2024-01-03, and Patrick Wardle (Objective-See) published a full analysis on 2024-01-04, 'Analyzing DPRK's SpectralBlur'. The sample was observed at /Users/Shared/.macshare and also named mac.jpg. The leading dot hides the binary from default Finder and ls views.

The backdoor loads an encrypted configuration from a file whose name is the binary path with a .d suffix (for example macshare.d). Both the configuration and the C2 network traffic are protected with a custom stream cipher implemented in an 'xcrypt' function. The key is derived from a random 64-bit value combined with a timestamp. At runtime the malware forks multiple child processes and opens a pseudo-terminal with posix_openpt/grantpt, which Objective-See assesses complicates dynamic analysis and perhaps detection.

The malware dispatches 15 command handlers: 0x1 proc_none, 0x2 proc_shell (run commands via the pseudo-terminal), 0x3 proc_dir (directory listing), 0x4 proc_upload, 0x5 proc_upload_content, 0x6 proc_download, 0x7 proc_rmfile (overwrite the file with zeros, then delete), 0x8 proc_testconn, 0x9 proc_getcfg, 0xa proc_setcfg, 0xb proc_hibernate, 0xc proc_sleep, 0xd proc_die, 0xe proc_stop and 0xf proc_restart. The source analysis does not identify the infection vector, the C2 address, or any in-the-wild victims.

Attribution rests on overlap with KANDYKORN (SockRacket), the macOS RAT Elastic Security Labs attributed to DPRK/Lazarus in November 2023, and on Proofpoint's Lesnewich assessing that TA444 debuted SpectralBlur in August 2023. TA444 is also tracked as BlueNoroff, APT38, Stardust Chollima, BlackAlicanto, Coperenicum and Sapphire Sleet, and has deployed RustBucket and ObjCShellz against macOS. Objective-See cautions that the similarities may reflect 'families developed by different folks with the same sort of requirements', so attribution confidence is MEDIUM. The network IOCs in this record belong to the related KANDYKORN intrusion set (Elastic REF7001), not to a confirmed SpectralBlur campaign. BeaconBeagle returned no match (HTTP 404) for 192.119.64.43 or 23.254.226.90.

## MITRE ATT&CK

- T1059.004 Unix Shell
- T1106 Native API
- T1564.001 Hidden Files and Directories
- T1070.004 File Deletion
- T1027 Obfuscated Files or Information
- T1005 Data from Local System
- T1573.001 Symmetric Cryptography

## Sources

- [Analyzing DPRK's SpectralBlur](https://objective-see.org/blog/blog_0x78.html)
- [SpectralBlur macOS Backdoor (The Hacker News)](https://thehackernews.com/2024/01/spectralblur-new-macos-backdoor-threat.html)
- [North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught (Dark Reading / Proofpoint)](https://www.darkreading.com/threat-intelligence/north-korea-debuts-spectralblur-malware-amid-macos-onslaught/)
- [Elastic catches DPRK passing out KANDYKORN](https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn)
- [SpectralBlur macOS Backdoor (PolySwarm)](https://blog.polyswarm.io/spectralblur-macos-backdoor)
- [KANDYKORN macOS Malware (The Hacker News)](https://thehackernews.com/2023/11/north-korean-hackers-tageting-crypto.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4894