Loading malware…
ChillyHell is a modular macOS backdoor targeting Intel-based Macs. Public reporting links it to UNC4487, a cluster assessed by Mandiant as a suspected espionage actor that has used compromised Ukrainian websites to socially engineer victims into executing malware. Evidence indicates ChillyHell has been active since at least 2021 and remained largely undetected for years despite being developer-signed and passing Apple notarization.
After execution, ChillyHell profiles the infected host, establishes persistence through multiple macOS mechanisms, and initiates command-and-control communications over HTTP or DNS. Reported persistence methods include LaunchAgent installation, LaunchDaemon installation, and shell profile modification so the malware can run at login, system startup, or when a new shell session is opened. Its modular architecture supports remote command execution, reverse shell access, downloading updated versions of itself, and fetching additional payloads.
ChillyHell also employs defense-evasion techniques designed to reduce user suspicion and hinder detection. Reported behaviors include timestomping of created artifacts and opening a benign decoy web page in the default browser. Some reporting also attributes password-cracking and user-account enumeration functionality to the malware, indicating support for brute-force activity and follow-on intrusion operations.
ChillyHell has been associated with targeted operations rather than broad commodity distribution. Apple has revoked developer certificates associated with known samples, but the malware is notable as an example of signed and notarized malicious code on macOS.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A dormant macOS threat is showing signs of new life, according to a report from cybersecurity firm Jamf. The company has been closely monitoring a macOS backdoor named ChillyHell, which has been active since 2021.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
UNC4487 is a suspected espionage actor that has been observed compromising the websites of Ukrainian government entities to redirect and socially engineer targets to execute Matanbuchus or CHILLYHELL malware.
Une fois installé, il permet l’exécution de commandes arbitraires
UNC4487 is a suspected espionage actor that has been observed compromising the websites of Ukrainian government entities to redirect and socially engineer targets to execute Matanbuchus or CHILLYHELL malware.
Il exploite des mécanismes avancés de persistance tels que « LaunchAgents et LaunchDaemons » intégrés au système d'exploitation ... Les attaquants créent des fichiers de configuration « .plist » pointant vers leur binaire malveillant. Ainsi, à chaque démarrage de l’ordinateur ou connexion d’utilisateur, le malware est relancé automatiquement
To set up persistence, CHILLYHELL either installs itself as a LaunchAgent or a system LaunchDaemon.
As a backup mechanism, it alters the user's shell profile (.zshrc, .bash_profile, or .profile) to inject a launch command into the configuration file.
Il exploite des mécanismes avancés de persistance tels que « LaunchAgents et LaunchDaemons » intégrés au système d'exploitation ... Les attaquants créent des fichiers de configuration « .plist » pointant vers leur binaire malveillant. Ainsi, à chaque démarrage de l’ordinateur ou connexion d’utilisateur, le malware est relancé automatiquement
To set up persistence, CHILLYHELL either installs itself as a LaunchAgent or a system LaunchDaemon.
As a backup mechanism, it alters the user's shell profile (.zshrc, .bash_profile, or .profile) to inject a launch command into the configuration file.
to stay hidden from the user, the malware opens a decoy Google.com page in a browser, which can minimise suspicion.
A noteworthy tactic adopted by the malware is its use of timestomping to modify the timestamps of created artifacts to avoid raising red flags.
Une fois installé, il permet ... des attaques de type force brute
Une fois installé, il permet ... le vol d’identifiants
Once executed, the malware extensively profiles the compromised host
run a module named ModuleSUBF to enumerate user accounts from "/etc/passwd"
Once executed, the malware extensively profiles the compromised host and establishes persistence using three different methods, following which it initializes command-and-control (C2) communication with a hard-coded server ... over HTTP or DNS
CHILLYHELL supports a wide range of commands that allow it to launch a reverse shell to the C2 IP address
Une fois installé, il permet ... l’installation de modules additionnels
it could be used for remote access... connecting to a remote server to give the attacker a command line to control the computer
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.