Loading malware…
Komplex is a macOS trojan associated with APT28, also known as Sofacy or Fancy Bear, and used as an initial-stage implant in espionage operations. It is known as an OS X implant that establishes a foothold on Mac systems and is assessed to have been used to deliver follow-on tooling, including the macOS variant of XAgent. Komplex has been described as a binder-style package containing a dropper, a payload, and a decoy document, with execution designed to display a lure document while installing the malware in the background.
On infected systems, Komplex stores its payload in a hidden directory and establishes persistence through a user LaunchAgent loaded with launchctl. Its functionality includes collecting host information such as the current username and a list of running processes, communicating with command-and-control infrastructure over HTTP POST, downloading and executing additional files, and deleting files on command. Its command-and-control traffic uses a custom XOR-based obfuscation scheme. The malware’s use of hidden storage locations and LaunchAgent persistence reflects a focus on defense evasion and long-term access.
Komplex is notable as one of the better-known macOS implants linked to APT28’s broader cross-platform malware ecosystem. It has been tied to targeted delivery via email attachment and decoy-document lures, consistent with spearphishing-based intrusion activity against espionage targets. Its role appears to be that of an initial access and staging component rather than a full-featured surveillance platform, with more advanced collection and post-compromise activity likely delegated to later-stage payloads.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2016-09-26 ⋅ Palo Alto Networks Unit 42 ⋅ Sofacy’s ‘Komplex’ OS X Trojan
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Multiple entries describe APT28/Pawn Storm/Sofacy campaigns using lure documents, themed emails, and phishing schemes, e.g., “APT28 Hacker Group Targeting Europe, Americas, Asia in Widespread Phishing Scheme”, “New Spear Phishing Campaign Pretends to be EFF”, and “distribution of emails with 'instructions' on 'updating the operating system'”.
The Komplex Dropper: Its main functionality is to drop a third Komplex component: the final payload, and ensure persistence on the infected system
The Komplex Dropper: Its main functionality is to drop a third Komplex component: the final payload, and ensure persistence on the infected system
The Komplex Dropper: Its main functionality is to drop a third Komplex component: the final payload, and ensure persistence on the infected system
The Komplex Trojan is a binder with multiple parts: a dropper, a payload and a decoy pdf file.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.
Komplex: loops until "connectedToInternet()" returns true before proceeding
The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
Multiple malware families and threat groups are described as collecting the victim username or enumerating logged-on users (e.g., “can collect the username from the victim’s machine”, “enumerates the current user during the initial infection”, “enumerates logged-on users”).
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
The agent starts by selecting a C&C server from a hardcoded list, then sends a hello message and starts two main communications threads... One for receiving commands ... in an infinite GET loop. One for sending data ... in an infinite POST loop.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.
The Komplex Payload: Is the final component of the Komplex malware, with the sole purpose of downloading and executing a file, as requested by the C&C servers.
The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.
"3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode..."; "APT33 has used AES for encryption of command and control traffic."; "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode)."; "Duqu ... data stream can be encrypted with AES-CBC."; "PoisonIvy uses the Camellia cipher to encrypt communications."
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
macOS trojan/backdoor associated with Sofacy/APT28.
Resources # # 20 Common Tools & Techniques used by macOS threat Actors & Malware [[URL_a0f294a8_41]] Mitre Attack Technique: launchctl T1569 [[URL_a0f294a8_42]] MITRE ATT&CK T1543.001 Create or Modify System Process: Launch Agent [[URL_a0f294a8_43]] Komplex OS X Trojan (Sofacy) [[URL_a0f294a8_44]]
Backdoor whose OsInfo function collects the current running username.
Trojan malware that supports file deletion.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.