Shares tags: macOS, BeaverTail, HiddenRisk • Shares 2 IOCs • Published within a month
2024 macOS Malware Review | Infostealers, Backdoors, and APT Campaigns Targeting the Enterprise
2025-01-20 • Sentinel One •
SentinelOne's macOS malware review highlights DPRK-linked activity against job seekers and cryptocurrency targets during 2024. The BeaverTail section describes North Korean operators impersonating recruiters on LinkedIn, X, and Freelancer, then pushing trojanized MiroTalk or FreeConference applications that steal browser credentials, target cryptocurrency wallet extensions, and can deploy InvisibleFerret for keylogging, file theft, and remote-control tooling. The ToDoSwift and Hidden Risk sections describe BlueNoroff-attributed crypto lures, including signed macOS applications that display decoy Bitcoin or crypto news PDFs while downloading second-stage backdoors from actor-controlled domains such as buy2x[.]com and matuaner[.]com. The report ties these cases to broader Contagious Interview, Operation In(ter)ception, and Operation Dream Job tradecraft.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| IPv4 | 95.164.17.24 | 2024-07-15 | 2026-04-01 |
| HASH | db3ec2bb2a18289b67cd15598b1bcf8… | 2025-01-20 | 2025-01-20 |
| HASH | e02b3309c0b6a774a4d940369633e39… | 2025-01-20 | 2025-01-20 |
| HASH | d9b0fcd3b20a82b97b4c74deebc7a2a… | 2025-01-20 | 2025-01-20 |
| HASH | aca17ec46730f5677d0d0a995b65504… | 2025-01-20 | 2025-01-20 |
| HASH | 0cca3449ff12cb75c9fd9cf4628b5d7… | 2025-01-20 | 2025-01-20 |
| HASH | 49b2b3b2de5d2d9814c7e71b081682f… | 2025-01-20 | 2025-01-20 |
| HASH | 1400210f2eedab36caff8ce89d6d198… | 2025-01-20 | 2025-01-20 |
| HASH | 6210ec0e905717359e01358118781a1… | 2025-01-20 | 2025-01-20 |
| HASH | ffeed91c223a718c1afd6d8f059a76e… | 2025-01-20 | 2025-01-20 |
| HASH | f69dd48ae8eb3767398316ad8bfa4a2… | 2025-01-20 | 2025-01-20 |
| HASH | ddf974c578d48c72581cb2363245233… | 2025-01-20 | 2025-01-20 |
| HASH | 7af7422edf7c558b6215489c020673e… | 2025-01-20 | 2025-01-20 |
| HASH | d006d5864108094a82315ee60ce057a… | 2025-01-20 | 2025-01-20 |
| HASH | c689113a9a2fca2148caa90f71115c2… | 2025-01-20 | 2025-01-20 |
| HASH | 1e07585f52be4605be0459bc10c6759… | 2025-01-20 | 2025-01-20 |
| HASH | 5d78fc86a389247d768a6bdf46f3e4f… | 2025-01-20 | 2025-01-20 |
| HASH | f39aafb9489b9b60b34e3d4e78cd972… | 2025-01-20 | 2025-01-20 |
| HASH | a28af0684456c26da769a2e0d29c5a7… | 2025-01-20 | 2025-01-20 |
| HASH | 14fe0071e76b23673569115042a9611… | 2025-01-20 | 2025-01-20 |
| HASH | ef1c7d6651996a3dccee755630add52… | 2025-01-20 | 2025-01-20 |
| HASH | a1f7d6c013b97f3685effb38aefb685… | 2025-01-20 | 2025-01-20 |
| HASH | f3c101cd1e7be4ce6afe5d0236bfdd5… | 2025-01-20 | 2025-01-20 |
| HASH | 2e62c9850f331799f1e4893698295d0… | 2025-01-20 | 2025-01-20 |
| HASH | 87393d937407a6fe9e69dad3836e838… | 2025-01-20 | 2025-01-20 |
| IPv4 | 43.156.13.232 | 2025-01-20 | 2025-01-20 |
| IPv4 | 103.27.109.217 | 2025-01-20 | 2025-01-20 |
| IPv4 | 45.77.179.89 | 2025-01-01 | 2025-01-20 |
| HASH | 176e8a5a7b6737f8d3464c18a77deef… | 2024-11-13 | 2025-01-20 |
| DOMAIN | matuaner.com | 2024-11-07 | 2025-01-20 |
| IPv4 | 45.140.147.208 | 2024-09-04 | 2025-01-20 |
| DOMAIN | buy2x.com | 2024-08-16 | 2025-01-20 |
Related Reports
Shares tag: macOS • Same author: Sentinel One • Published within a month
2024-11-07 •
38% Match
BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence
Sentinel One
Shares tags: macOS, HiddenRisk • Shares 2 IOCs • Same author: Sentinel One
2025-02-04 •
36% Match
#macOS
#BeaverTail
#InvisibleFerret
#Lazarus
#OtterCookie
#FlexibleFerret
#FriendlyFerret
Shares tags: macOS, BeaverTail • Published within a month
Shares tag: Trend • Published within a month
Shares tag: Trend • Published within a month