Loading malware…
KANDYKORN is a sophisticated macOS backdoor/RAT associated with DPRK activity, including Lazarus/BlueNoroff-linked operations targeting blockchain engineers and cryptocurrency-related organizations in 2023. Reported targeting includes blockchain engineers at a crypto exchange platform and broader Web3/macOS intrusion chains.
The malware was delivered through a multi-stage social-engineering infection chain. In one reported campaign, victims were contacted over Discord and induced to download a malicious Python application archive, Cross-Platform Bridges.zip. Main.py imported Watcher.py, which checked the local Python version and downloaded and executed additional components including testSpeed.py and FinderTools. FinderTools wrote itself to /Users/Shared/FinderTools, downloaded and executed the Mach-O loader SUGARLOADER at /Users/Shared/.sld, and also copied SUGARLOADER into the Discord application hierarchy as hidden files under /Applications/Discord.app/Contents/MacOS/. SUGARLOADER then downloaded HLOADER, wrote it to /Applications/Discord.app/Contents/MacOS/Discord, and HLOADER renamed the legitimate Discord executable to .lock and restored it during execution to maintain persistence. SUGARLOADER checked for configuration at /Library/Caches/com.apple.safari.ck, accepted a hardcoded C2 argument from FinderTools, and in one observed intrusion used 23.254.226.90 over TCP port 44. Elastic also observed FinderTools using tp.globa.xyz as C2 infrastructure.
KANDYKORN itself is a C++ RAT/backdoor. SUGARLOADER loaded it directly in memory using NSCreateObjectFileImageFromMemory and NSLinkModule. Multiple samples were identified in 2023, including one written to /Users/Shared/.pld with SHA1 26ec4630b4d1116e131c8e2002e9a3ec7494a5cf. Reporting also links KANDYKORN to overlapping DPRK macOS tooling and infrastructure with RustBucket-related SwiftLoader variants. Researchers assessed with medium confidence that RustBucket SwiftLoader droppers were reused to deliver KANDYKORN payloads, based on shared infrastructure, file paths, and objectives. One SwiftLoader-delivered downloader at /Users/Shared/.pw referenced /Users/Shared/.pld, and related infrastructure included on-global.xyz and swissborg.blog.
KANDYKORN has also been referenced in later BlueNoroff/SnatchCrypto reporting as part of the actor’s macOS malware ecosystem alongside ObjCShellz, TodoSwift, SysPhon, and SUGARLOADER. Persistence associated with KANDYKORN activity included a LaunchAgent as the primary mechanism, with shell configuration hijacking used as a failsafe.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Given this execution flow and SugarLoader’s historical role in retrieving the KANDYKORN malware, it is likely that the final payload in the chain would be KANDYKORN or another fully-featured backdoor.
other campaigns have leveraged malware families like KANDYKORN, ObjCShellz, and TodoSwift.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Python scripts were used to drop malware that hijacked the host’s installed Discord app... Watcher.py checks the local Python version and downloads and executes testSpeed.py. The script downloads and executes another Python script, FinderTools.
SUGARLOADER uses this to retrieve and execute the KANDYKORN remote access trojan in-memory via NSCreateObjectFileImageFromMemory and NSLinkModule.
In the previous post, we analyzed how LaunchAgents work... LaunchAgents are great, but they have a flaw: macOS likes to scream about them with a “Background Items Added” notification... While their primary persistence was a LaunchAgent, they used shell configuration hijacking as a failsafe.
Today, I’ll talk about shell environment hijacking trick... The two most interesting files for us are: ~/.zshrc - executed for interactive shells... ~/.zshenv - executed for every instance of zsh... So, the main trick: we append a command to run our malware at the end of these files.
In the previous post, we analyzed how LaunchAgents work... LaunchAgents are great, but they have a flaw: macOS likes to scream about them with a “Background Items Added” notification... While their primary persistence was a LaunchAgent, they used shell configuration hijacking as a failsafe.
Today, I’ll talk about shell environment hijacking trick... The two most interesting files for us are: ~/.zshrc - executed for interactive shells... ~/.zshenv - executed for every instance of zsh... So, the main trick: we append a command to run our malware at the end of these files.
SwiftLoader’, which functioned externally as a PDF Viewer for a lure document sent to targets... a malicious Python application disguised as a cryptocurrency arbitrage bot.
The main executable uses curl to reach out to docs-send.online/getBalance/usdt/ethereum... communicating over TCP port 44.
Watcher.py checks the local Python version and downloads and executes testSpeed.py... FinderTools downloads and executes a Mach-O binary, dubbed SUGARLOADER... SUGARLOADER also downloads a Mach-O payload dubbed HLOADER.
The main feature of CosmicDoor is that it communicates with the C2 server using the WSS protocol, and it provides remote control functionality such as receiving and executing commands... SneakMain... receives additional AppleScript commands and uses the osascript -e command to execute them.
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A sophisticated macOS implant used by Lazarus Group against blockchain engineers, with shell configuration hijacking used as a fallback persistence mechanism to re-download or re-execute the loader if the primary LaunchAgent persistence was removed.
Referenced as a malware family leveraged in related BlueNoroff macOS-targeting campaigns; this content does not provide functional details beyond being delivered by SUGARLOADER in prior activity.
Referenced as a DPRK-linked malware/tool in a cited resource only; no behavioral details are provided in the content itself.
Malware used in a DPRK-linked campaign targeting blockchain engineers at a crypto exchange platform.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.