ObjCShellz Malware Linked to NK Threat Actor BlueNoroff

The nation-state group BlueNoroff, associated with North Korea, is now linked to an undisclosed macOS malware strain called ObjCShellz, as revealed by Jamf Threat Labs. This malware is part of the RustBucket malware campaign unveiled earlier this year. According to security researcher Ferdous Saljooki, analyzing past BlueNoroff attacks suggests that this malware functions as a late stage in a multi-stage attack delivered through social engineering.

BlueNoroff, also known by aliases APT38, Nickel Gladstone, Sapphire Sleet, Stardust Chollima, and TA444, operates as a subordinate unit of the notorious Lazarus Group. Specializing in financial crimes, BlueNoroff targets banks and the crypto sector to circumvent sanctions and generate illicit profits for the regime.

This revelation follows Elastic Security Labs' disclosure of the Lazarus Group's use of a new macOS malware called KANDYKORN to target blockchain engineers. Additionally, RustBucket, an AppleScript-based backdoor associated with BlueNoroff, is employed to retrieve a second-stage payload from a server controlled by the attacker.

Job Offers Used as Bait in Infection Chain

The attacks orchestrated by BlueNoroff involve enticing potential targets with promises of investment advice or job opportunities, initiating the infection chain through a decoy document.

Although researchers lack specific information on the targets, recent attacks and domain names used by the attackers suggest a focus on companies in the cryptocurrency industry or closely associated with it. The precise initial access vector for the attack remains unknown, but suspicions point to the delivery of the malware as a post-exploitation payload for manually running commands on the compromised machine.