# The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)

> Objective-See's annual review catalogs macOS malware discovered in 2023, including ransomware (LockBit for macOS, Turtle), info-stealers (PureLand, Realst, MetaStealer, AtomicStealer, JaskaGO, MacStealer, GoSorry) and APT malware (SmoothOperator/3CX, RustBucket, NokNok, KandyKorn, ObjCShellz, JumpCloud-related FullHouse.Doored/StratoFear/TieDye, JokerSpy). Several are attributed to DPRK (Lazarus/BlueNoroff) and NokNok to Iran's APT42/Charming Kitten.

- **Published:** 2026-10-31T09:54:24Z
- **Last reviewed:** 2026-10-31T09:54:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4895
- **ID:** TL-2026-4895
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea, Iran)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record summarizes the Objective-See 'Mac Malware of 2023' retrospective (Patrick Wardle). It is a roundup of many distinct families rather than a single campaign, so attribution and TTPs vary per family.

Ransomware: LockBit for macOS (sample locker_Apple_M1_64, encrypts files with AES and appends the .lockbit extension, drops a '!!!-Restore-My-Files-!!!' note, logs to /tmp/locker.log, strings XOR-encoded with key 0x39) and Turtle (TurtleRansom-v0-macos-arm64.pkg, AES-CTR encryption of .doc/.docx/.txt files with the .TURTLERANSv0 suffix). Neither was observed with persistence.

Info-stealers: PureLand (fake play-to-earn game sent from a compromised Sandbox employee's email; C2 193.168.141.107:8888), Realst (Rust-based, fake blockchain games distributed via Discord social engineering; 'Pearl Land Launcher.pkg' installs to /Library/PearLand/1.6.2/ and reuses firefox_decrypt.py and chainbreaker), MetaStealer (Go-based, business-themed disk images, exfil to api.osx-mac.com and builder.osx-mac.com), AtomicStealer/AMOS (malvertising and a fake TradingView site, C2 185.106.93.154 via HTTP POST to /sendlog, fake password prompts via osascript), JaskaGO (fake CapCut installer on pirated-software sites, persistence via LaunchAgent service.plist or LaunchDaemon Init.plist, runs commands with sudo), MacStealer (Python-compiled Mach-O named 'weed' sold on dark web forums, C2 mac.cracked23.site plus Telegram exfiltration) and GoSorry (Go dylib liboptimizer.dylib targeting browser data and crypto wallets).

APT malware: the 3CX Desktop App supply-chain compromise (SmoothOperator; trojanized, signed and Apple-notarized app; libffmpeg.dylib stage 1 downloads UpdateAgent stage 2; C2 sbmsa.wiki/blog/_insert and msstorageboxes.com; DPRK-attributed); RustBucket (BlueNoroff; fake PDF viewer plus trigger PDF; Rust final-stage backdoor; anti-VM check via system_profiler; C2 deck.31ventures.info; spoofed MSIE 8 user agent); NokNok (Charming Kitten/APT42/TA453; password-protected ZIP in phishing emails; Swift backdoor persisting via LaunchAgent org.Finder.plist; base64-encoded survey data); KandyKorn (DPRK; Discord social engineering of crypto engineers with a fake arbitrage bot; HLOADER hijacks Discord.app execution flow; 16-command backdoor); ObjCShellz (BlueNoroff; downloads and executes payloads, Swift variant drops /Users/Shared/.pld with chmod 0777); the JumpCloud compromise (DPRK; init.rb Ruby script delivered through the JumpCloud agent downloads lic.dat/lic_bak.dat from primerosauxiliosperu.com to /usr/local/bin/com.docker.vmnat; payloads FullHouse.Doored, StratoFear with LaunchDaemons masquerading as Zoom/Google Keystone/Teams, and TieDye); and JokerSpy (suspected DPRK; xcc TCC.db checker, shared.dat and sh.py Python backdoors; targeted a Japanese crypto exchange; components seen spawned from IntelliJ IDEA, iTerm2 and VS Code).

Also covered: SparkRAT (open-source Go RAT, tracked as DragonSpark by SentinelOne), Geacon/Geacon Plus (Go Cobalt Strike implementations), WSClient (trojan-proxy in cracked apps, DoH C2 resolution via cloudflare-dns.com, persistence via GoogleHelperUpdater.plist), iWebUpdater, a new XLoader variant disguised as OfficeNote, XMRig-based CoinMiner/I2Pminer variants, and the dark-web-advertised hVNC and ShadowVault. A macOS variant of the Triangulation implant was suspected but not detected in the wild. Objective-See concludes that behavior-based detection outperforms signatures for novel macOS threats.

No CVEs or CVSS scores are stated in the article. Severity and status are analyst assessments.

## MITRE ATT&CK

- T1566 Phishing
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.002 AppleScript
- T1059.004 Unix Shell
- T1543.001 Launch Agent
- T1543.004 Launch Daemon
- T1574 Hijack Execution Flow
- T1036.005 Match Legitimate Resource Name or Location
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1056.002 GUI Input Capture
- T1082 System Information Discovery
- T1057 Process Discovery
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication

## Sources

- [The Mac Malware of 2023 (Objective-See)](https://objective-see.org/blog/blog_0x77.html)
- [Objective-See: 3CX supply chain analysis (0x74)](https://objective-see.org/blog/blog_0x74.html)
- [NCSC Malware Analysis Report: Smooth Operator](https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/smooth-operator/NCSC_MAR-Smooth-Operator.pdf)
- [Uptycs: 3CX supply chain attack](https://www.uptycs.com/blog/3cx-supply-chain-attack)
- [SentinelOne: 3CXDesktopApp supply chain attack](https://www.sentinelone.com/tw/blog/3cxdesktopapp-exposes-supply-chain-attack-risk/)
- [Sophos: 3CX DLL sideloading attack](https://www.sophos.com/blog/3cx-dll-sideloading-attack)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4895