Loading malware…
SIMPLESEA is a backdoor name initially used by Mandiant during incident response to the March 2023 3CX supply-chain compromise. It was identified in the 3CX environment, including references describing it as a macOS backdoor found during the 3CX investigation. However, Mandiant later corrected this identification and stated the malware on 3CX’s macOS build server was actually POOLRAT, a known Lazarus malware family, using Launch Daemons for persistence. Based on the provided content, SIMPLESEA is therefore best understood as an initial label rather than the final malware family attribution. The broader 3CX incident involved trojanized Windows and macOS 3CXDesktopApp installers that enabled arbitrary code download and execution, with the macOS activity involving a malicious libffmpeg.dylib, environment collection, C2 communication, and deployment of a second-stage payload called UpdateAgent. The campaign has been linked by multiple vendors to Lazarus, though the specific SIMPLESEA label was superseded by POOLRAT in Mandiant’s later findings.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct technique documented for this family, organized by ATT&CK tactic.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor name initially reported by Mandiant during incident response in the 3CX environment; later reporting corrected this identification to POOLRAT.
macOS backdoor referenced from the 3CX incident response; noted for implementing the A5/1 stream cipher and sharing related crypto/keying artifacts with Lazarus Linux tooling discussed in the report.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.