Loading malware…
OSX_OCEANLOTUS.D is a macOS backdoor identified by Trend Micro as a malware variant used by OceanLotus, also known as APT32, APT-C-00, SeaLotus, and Cobalt Kitty. The reported sample was delivered via a malicious Microsoft Word document, likely distributed by email, themed as a Vietnamese event registration form and requiring users to enable obfuscated macros. The macro executed a Perl-based payload that extracted and ran a Mach-O dropper, which then installed the final 64-bit Mach-O backdoor. The attackers targeted macOS systems with Perl installed.
The malware installs itself differently depending on privilege level. When running as root, it installs under /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ as screenassistantd; for regular users, it installs under ~/Library/Spelling/ as spellagentd. The dropper sets the installed file’s attributes to hidden, changes timestamps using the touch -t command, changes permissions to 755, and deletes itself after loading the payload. It can also disguise its true file structure as an application bundle by adding special characters to the filename and using the icon of a legitimate Word document.
For persistence, OSX_OCEANLOTUS.D creates plist files including com.apple.screen.assistantd.plist or com.apple.spell.agent.plist and loads them with launchctl. Persistence is established via /Library/LaunchDaemons/ for root execution or ~/Library/LaunchAgents/; the content also explicitly notes it can create a persistence file in /Library/LaunchAgents. The plist entries use RunAtLoad and KeepAlive.
The backdoor collects host identifiers and system information, including serial number, hardware UUID, MAC address, OS version, username, computer name, and architecture. It derives a clientID from environment data plus a randomly generated UUID. Collected data and strings are protected with AES256 and base64 encoding, and the malware scrambles the AES256 session key before transmission. The content also states that OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to command-and-control servers.
For command and control, OSX_OCEANLOTUS.D has used a custom binary TCP protocol over port 443, with zlib compression applied to data after offset 0x52. For network communications it loads a dynamic library (.dylib) via dlopen() and resolves functions with dlsym(). Reported C2 servers include ssl.arkouthrie.com, s3.hiahornber.com, and widget.shoreoa.com.
Documented capabilities include downloading and executing files, running terminal commands, transferring files, and deleting files from the system via a dedicated command. The content also notes use of Word macros for execution and references PowerShell scripts in association with this malware. OceanLotus activity linked to this backdoor has previously targeted human rights organizations, media organizations, research institutes, and maritime construction firms.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We identified a MacOS backdoor (detected by Trend Micro as OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus... The dropper is used to install the backdoor into the infected system and establish its persistence.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal.
The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/ folder. The RunAtLoad key will command launchd to run the daemon when the operating system starts up... launchctl load ~/Library/LaunchAgents/ filename.plist
Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/ folder. The RunAtLoad key will command launchd to run the daemon when the operating system starts up... launchctl load ~/Library/LaunchAgents/ filename.plist
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
It extracts theme0.xml file from the Word document. theme0.xml is a Mach-O 32-bit executable... For root user path: /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ processname: screenassistantd For regular user path: ~/Library/Spelling/ processname: spellagentd
The app bundle is disguised as a doc file to trick users into executing it
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
Running getpwuid ->pw_name, scutil --get ComputerName, and uname –m will provide the following returns respectively: Mac OSX 10.12. System Administrator <owner’s name>'s iMac x86_64
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
Some Backdoor.Oldrea samples use standard Base64 + bzip2... gh0st RAT has used Zlib to compress C2 communications data before encrypting it... HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.
infoClient is responsible for collecting OS info, submitting this info to its C&C servers... Communication with the C&C server after the exchange of OS packet info... HandlePP::urlRequest (/appleauth/static/cssj/N252394295/widget/auth/app.css)
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
Like older versions of the OceanLotus backdoor, the new version contains two main functions: one for collecting operating system information and submitting this to its malicious C&C servers and receiving additional C&C communication information, and another for the backdoor capabilities.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom macOS backdoor associated with OceanLotus/APT32, noted for multi-layered persistence.
macOS malware referenced as using LoginHook-based persistence on macOS.
macOS malware that uses the touch -t command to alter timestamps.
Software changes: ... OSX_OCEANLOTUS.D
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.