CosmicDoor

In the GhostCall campaign, BlueNoroff poses as venture capitalists or startup founders seeking to “invest” in blockchain projects. The attackers set up fake video meetings via platforms like Zoom or Teams, luring victims into a false sense of legitimacy.

According to Kaspersky’s Securelist researchers, the campaigns rely on social engineering via platforms like Telegram and LinkedIn to send fake meeting invites and eventually deliver multi-stage malware chains to compromise macOS and Windows hosts.

The malware samples were found written in multiple programming languages, including Go, Rust, Nim, and AppleScript, reflecting an added technical layer in the group’s operations.

During or after these calls, the victim is asked to install a supposed “update” or “plugin” to improve connection quality. The file, of course, is malicious–triggering a chain of implants such as DownTroy, CosmicDoor, and Rootroy.

Victims are told to complete a “coding challenge” for a potential employer, only to receive a ZIP archive or Git repository containing the malware.

GillyInjector employs a technique known as Task Injection... designed to run a benign Mach-O app and inject a malicious payload into it at runtime... DownTroy.Windows would retrieve a base64-encoded binary blob... and inject it into the cmd.exe process... RealTimeTroy... injects the payload received from the C2.

The campaign also deploys exfiltration routines to extract sensitive project data back to BlueNoroff’s servers, often obfuscated with custom encryption and encoded in hexadecimal to avoid detection.

GillyInjector employs a technique known as Task Injection... designed to run a benign Mach-O app and inject a malicious payload into it at runtime... DownTroy.Windows would retrieve a base64-encoded binary blob... and inject it into the cmd.exe process... RealTimeTroy... injects the payload received from the C2.

The file, of course, is malicious–triggering a chain of implants such as DownTroy, CosmicDoor, and Rootroy, each performing specialized tasks like credential theft, keylogging, or persistence.

Once inside the target environment, the malware seeks out crypto wallet data, SSH keys, and project credentials–anything that could enable financial theft or lateral movement within corporate infrastructure.

all three DownTroy strains collect comprehensive system information including OS details, domain name, host name, username, proxy settings, and VM detection alongside process lists... SysPhon... conduct system reconnaissance by executing a series of commands.

Once inside the target environment, the malware seeks out crypto wallet data, SSH keys, and project credentials–anything that could enable financial theft or lateral movement within corporate infrastructure.

The file, of course, is malicious–triggering a chain of implants such as DownTroy, CosmicDoor, and Rootroy, each performing specialized tasks like credential theft, keylogging, or persistence.

The main feature of CosmicDoor is that it communicates with the C2 server using the WSS protocol... RealTimeTroy is a straightforward backdoor written in the Go programming language that communicates with a C2 server using the WSS protocol.

DownTroy would download ZIP files that contain various individual infection chains from the actor’s centralized file hosting server... When both the url and auth fields are present, RooTroy connects to the URL... to retrieve additional files.

The main feature of CosmicDoor is that it communicates with the C2 server using the WSS protocol, and it provides remote control functionality such as receiving and executing commands... SneakMain... receives additional AppleScript commands and uses the osascript -e command to execute them.

The attackers use multiple layers of staging and dynamic command-and-control switching, allowing the malware to remain dormant until it detects activity in crypto-related directories or developer tools.

The campaign also deploys exfiltration routines to extract sensitive project data back to BlueNoroff’s servers, often obfuscated with custom encryption and encoded in hexadecimal to avoid detection.