Loading story…
Doctor Web disclosed BackDoor.Olyx, a Mac OS X backdoor that gives attackers covert remote access to infected machines. The malware contacts a command server and supports file creation, transfer, renaming, and deletion, while also downloading and executing additional payloads and running shell commands through /bin/bash. To stay resident, it creates files under /Library/Application Support/google/ and /Library/LaunchAgents/, then hides its original presence by moving its executable to a temporary folder.
Additional analysis linked Olyx, also referred to as Wolyx, to both a Mac Mach-O sample and a related Windows PE sample, indicating cross-platform tooling around the same operation. Public sample reporting identified the Mac file with MD5 93a9b55bb66d0ff80676232818d5952f and a Windows executable with MD5 f65fbeb945348ad2e1a123ef5cee65d3, while observed network traffic was tied to IP 121.254.173.57 in South Korea. Doctor Web said detection for BackDoor.Olyx had been added to its virus database and urged Mac users to keep protections updated and scan systems regularly.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A Windows executable associated with Olyx/Wolyx, named "Video-Current events 2009 July 5.exe," was shown in the referenced analysis content with a submission timestamp of 2011-07-27 05:00:39 UTC. The sample was detected by multiple antivirus engines and linked in the post to Ghostnet-style backdoor activity.
On June 22, 2011, Doctor Web announced the discovery of BackDoor.Olyx, a Mac OS X backdoor that lets attackers remotely control infected systems, manipulate files, download and execute payloads, and run shell commands. The report also described its persistence mechanisms and noted that Dr.Web added detection for the malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **Mokes**, a cross-platform desktop backdoor family with Linux and Windows variants, later also linked to an OS X sample. The malware was designed for surveillance and data theft, supporting screenshots, keylogging, audio capture, and exfiltration of collected information. The Linux sample, detected as `Backdoor.Linux.Mokes.a`, was described as a UPX-packed `C++/Qt` implant statically linked with Qt, `xkbcommon`, and `OpenSSL 1.0.2c`, while the Windows samples were tracked as `Backdoor.Win32.Mokes.imv` and `Backdoor.Win32.Mokes.imw`. Both variants used similar persistence and command-and-control logic, indicating a shared code base and operator playbook. On Linux, Mokes established autostart persistence; on Windows, it used `Run` registry keys and added active keylogging, with code also present for webcam capture. The malware beaconed every minute to hardcoded HTTP command-and-control servers and used TCP port `433` with a custom encrypted protocol for commands and data transfer. Researchers also noted that one Windows sample was signed with a trusted certificate chaining to **COMODO RSA Code Signing CA**, a tactic that could help the malware appear legitimate and evade scrutiny.
Aug 14, 2026
Attackers have launched a sophisticated malvertising and SEO poisoning campaign to distribute the Oyster backdoor by promoting fake Microsoft Teams installers. The campaign leverages search engine advertisements and manipulated search results for queries like "Teams download," redirecting unsuspecting users to a fraudulent website, teams-install[.]top, which closely mimics the legitimate Microsoft Teams download page. Upon visiting this site, users are prompted to download an installer named "MSTeamsSetup.exe," a filename identical to the official Microsoft Teams installer, increasing the likelihood of deception. The installer is code-signed with certificates from entities such as "4th State Oy" and "NRM NETWORK RISK MANAGEMENT INC," lending further legitimacy to the malicious file. When executed, the installer drops a malicious DLL, CaptureService.dll, into the %APPDATA%\Roaming directory and establishes persistence by creating a scheduled task named "CaptureService" that runs every 11 minutes. This ensures the Oyster backdoor remains active even after system reboots. Oyster, also known as CleanUpLoader and Broomstick, is a commodity backdoor first observed in mid-2023 and has been linked to multiple campaigns, including those supporting ransomware operations like Rhysida. The malware provides attackers with remote access, command execution capabilities, and the ability to deploy additional payloads or exfiltrate files. The campaign's use of SEO poisoning and malvertising mirrors previous tactics used to distribute Oyster via fake installers for other popular IT tools such as PuTTY and WinSCP. Security researchers from Blackpoint SOC identified and analyzed the campaign, highlighting the ongoing abuse of user trust in search results and well-known brands to facilitate initial access to corporate networks. The malicious activity underscores the persistent threat posed by commodity backdoors distributed through deceptive online advertising and the importance of verifying software sources. The campaign does not spoof Microsoft's actual domain but relies on visual mimicry and legitimate-seeming code signatures to bypass user suspicion. The deployment of the Oyster backdoor through this method enables attackers to establish a foothold in targeted environments, potentially leading to further compromise or ransomware deployment. Organizations are advised to educate users about the risks of downloading software from unofficial sources and to implement technical controls to block access to known malicious domains. The incident demonstrates the evolving tactics of threat actors in leveraging trusted brands and digital advertising infrastructure to propagate malware. Security teams should monitor for indicators of compromise related to Oyster and similar backdoors, particularly those delivered via malvertising. The campaign's discovery highlights the need for vigilance in both user behavior and technical defenses against social engineering and software supply chain threats.
Jun 29, 2026
ESET reported that the **OceanLotus** threat group, also tracked as **APT32** and **APT-C-00**, deployed an updated backdoor against company and government networks in East Asia. The intrusion chain relied on social-engineering lures, including double-extension decoy files and fake software installers such as `RobototFontUpdate.exe`, to deliver a multi-stage dropper and backdoor. The malware used layered obfuscation, encrypted payloads, and shellcode-based PE loading to hinder analysis and detection. The campaign also abused **DLL side-loading** through legitimate signed executables, including Symantec’s `rastlsc.exe`, to execute malicious components while appearing trustworthy. After installation, the backdoor established persistence through a Windows service or `Run` registry key, then communicated with command-and-control servers over TCP port `25123` with fallback HTTP/HTTPS channels. ESET said the malware gave operators broad post-compromise access, including host fingerprinting, file and registry manipulation, process execution, and the ability to load additional payloads.
Aug 14, 2026