Huntress Links Deepfake Zoom Lure and macOS Malware Intrusion to BlueNoroff
Summary
Huntress attributes a cryptocurrency foundation employee’s macOS compromise to BlueNoroff with high confidence. Its investigation details a deepfake Zoom lure, persistent backdoors, process injection and malware targeting cryptocurrency wallet data.
Key points
- An attacker contacted the employee through Telegram and used a Calendly invitation that redirected to a fake Zoom site. Deepfakes impersonating company leaders urged the employee to install a purported Zoom extension.
- The downloaded zoom_sdk_support.scpt hid payload-download commands after more than 10,500 blank lines. A related second-stage script found on VirusTotal disabled shell history, installed Rosetta 2 if needed and repeatedly requested a password until sudo validation succeeded.
- Huntress recovered eight malicious binaries. The Nim-based Telegram 2 implant provided hourly LaunchDaemon persistence, while the Go-based Root Troy V4 backdoor downloaded and executed additional payloads.
- Root Troy V4 supported AppleScript and shell execution, reported host information to command-and-control infrastructure and queued commands until the display was asleep to reduce visibility.
- InjectWithDyld derived AES keys from a supplied password, decrypted embedded payloads and used debugging entitlements and Mach APIs to inject code into a sacrificial application. Its cleanup mode overwrote files with zeros.
- XScreen supported keystroke, clipboard and screen collection. CryptoBot searched browser wallet extensions for cryptocurrency-related information; the analysis does not establish a financial loss.
- Huntress attributed the intrusion to North Korea’s BlueNoroff with high confidence. The host was isolated during the investigation, and analysis of the additional Nim implant remained ongoing.
Article Details
- Attack Vectors
- A cryptocurrency foundation employee received a Telegram message with a Calendly invitation that appeared to schedule a Google Meet event but redirected to an attacker-controlled fake Zoom site.
- During a subsequent meeting, deepfakes impersonating company leadership and external contacts persuaded the employee to download a purported Zoom extension to resolve a microphone problem.
- The downloaded AppleScript initiated a multistage macOS infection involving persistent implants, remote command execution, process injection, surveillance, and cryptocurrency-related data collection.
- Defensive Notes
- Train employees to scrutinize unexpected or urgent calendar invitations, unusual combinations of meeting participants, and last-minute meeting-platform changes.
- Treat requests to install meeting extensions or plugins, enable remote access, or visit unfamiliar meeting-related domains as warning signs.
- If suspicious behavior or uncertainty arises, disconnect the meeting software immediately and report the incident to security, HR, and other appropriate teams.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | productnews[.]online | CryptoBot C2 domain used for HTTP communications. |
| DOMAIN | readysafe[.]xyz | Listed as threat infrastructure associated with the intrusion; its specific role is not disclosed. |
| DOMAIN | safefor[.]xyz | Infrastructure table identifies this domain as C2 for RTV4. |
| SHA256 | 080a52b99d997e1ac60bd096a626b4d7c9253f0c7b7c4fc8523c9d47a71122af | SHA256 of payload, the decrypted Nim implant with command-execution capability. |
| SHA256 | 14e9bb6df4906691fc7754cf7906c3470a54475c663bd2514446afad41fa1527 | SHA256 of Telegram 2, the persistent Nim implant. |
| SHA256 | 1ddef717bf82e61bf79b24570ab68bf899f420a62ebd4715c2ae0c036da5ce05 | SHA256 of zoom_sdk_support.scpt, the initial malicious AppleScript disguised as a Zoom extension. |
| SHA256 | 432c720a9ada40785d77cd7e5798de8d43793f6da31c5e7b3b22ee0a451bb249 | SHA256 of keyboardd, the XScreen keylogger and screen recorder. |
| SHA256 | 469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f | SHA256 of netchk, a recovered intrusion binary described as generating random numbers indefinitely and listed as an injection candidate. |
| SHA256 | 4cd5df82e1d4f93361e71624730fbd1dd2f8ccaec7fc7cbdfa87497fb5cb438c | SHA256 of a, the InjectWithDyld C++ loader that decrypts payloads and performs process injection. |
| SHA256 | ad01beb19f5b8c7155ee5415781761d4c7d85a31bb90b618c3f5d9f737f2d320 | SHA256 of remoted, the Root Troy V4 Go backdoor. |
| SHA256 | ad21af758af28b7675c55e64bf5a9b3318f286e4963ff72470a311c2e18f42ff | SHA256 of airmond, the CryptoBot cryptocurrency-focused infostealer. |
| URL | hxxps[:]//metamask[.]awaitingfor[.]site/update | XScreen keylogger C2 endpoint listed in the infrastructure table; the analysis identifies it as the configured collection destination. |
| URL | hxxps[:]//safeupload[.]online | Listed as threat infrastructure associated with the intrusion; its specific role is not disclosed. |
| URL | hxxps[:]//support[.]us05web-zoom[.]biz/842799/check | IOC table identifies this Telegram-delivered URL as downloading the initial AppleScript payload. |
| URL | hxxps[:]//support[.]us05web-zoom[.]biz/troubleshoot-issue-727318 | Fake Zoom extension link delivered through Telegram that downloaded zoom_sdk_support.scpt. |
MITRE ATT&CK
T1005 · Data from Local SystemCryptoBot searches installed browser wallet extensions and extracts cryptocurrency-related information from the host.T1055 · Process InjectionInjectWithDyld obtains a sacrificial process's Mach task port, copies decrypted payload segments into its memory, changes memory protections, and resumes execution.T1056.001 · KeyloggingXScreen uses the Core Graphics EventTapCreate API to capture keystrokes and records the active application's identity.T1057 · Process DiscoveryRoot Troy V4 periodically collects the running process list and sends it to its C2 server.T1059.002 · AppleScriptThe initial payload used AppleScript, and Root Troy V4 could execute remote AppleScript through osascript -e.T1059.004 · Unix ShellTelegram 2 executes commands through /bin/bash, while Root Troy V4 supports foreground and detached commands through /bin/zsh -sc.T1070.003 · Clear Command HistoryThe analyzed second-stage script disables bash history logging and removes shell history; investigators observed history files modified at the attack time.T1071.001 · Web ProtocolsCryptoBot communicates with productnews[.]online over HTTP, Root Troy V4 sends requests to an /update endpoint, and the Nim implant uses WebSockets.T1105 · Ingress Tool TransferThe initial AppleScript downloads another payload, and Root Troy V4 repeatedly downloads and executes additional implants.T1113 · Screen CaptureXScreen captures each active display using CGDisplayCreateImage and sends base64-encoded images to its C2.T1115 · Clipboard DataXScreen monitors the system pasteboard and appends changed clipboard text to its collection buffer.T1140 · Deobfuscate/Decode Files or InformationInjectWithDyld derives AES keys from a supplied password and decrypts embedded payloads using a modified AES-CFB implementation.T1204.002 · Malicious FileDeepfake meeting participants persuaded the employee to download the malicious zoom_sdk_support.scpt file as a purported Zoom extension.T1543.004 · Launch DaemonTelegram 2 persists through /Library/LaunchDaemons/com.telegram2.update.agent.plist, configured to start hourly.T1566.002 · Spearphishing LinkThe attacker delivered meeting and fake Zoom-extension links through Telegram to lure the employee into downloading malware.
People
Threat Actors
BlueNoroffHuntress attributes the intrusion with high confidence to this DPRK subgroup and explicitly identifies BlueNoroff, Sapphire Sleet, COPERNICIUM, STARDUST CHOLLIMA, and CageyChameleon as aliases.CageyChameleonExplicitly identified as an alias of TA444, the DPRK subgroup to which Huntress attributes the intrusion with high confidence.COPERNICIUMExplicitly identified as an alias of TA444, the DPRK subgroup to which Huntress attributes the intrusion with high confidence.Sapphire SleetExplicitly identified as an alias of TA444, the DPRK subgroup to which Huntress attributes the intrusion with high confidence.STARDUST CHOLLIMAExplicitly identified as an alias of TA444, the DPRK subgroup to which Huntress attributes the intrusion with high confidence.
Malware
CryptoBotCryptoBot (airmond): an infostealer written in Go that is designed to collect cryptocurrency related files from the host.InjectWithDyldInjectWithDyld (a): a binary loader written in C++ that is downloaded by Root Troy V4.NetChkNetChk: an almost empty binary that will generate random numbers forever.Nim ImplantDecrypted Payloads: Nim Implant (Trojan 1) & Base App Root Troy V4Root Troy V4 (remoted): fully featured backdoor, written in Go, and used to download the other payloads as well as run them.Telegram 2Telegram 2: the persistent binary, written in Nim, responsible for starting the primary backdoor.XScreenXScreen (keyboardd): a keylogger written in Objective-C that has capability to monitor keystrokes, the clipboard, and the screen.
Products
macOSBut, historically process injection hasn’t been common on macOS because there’s a large number of prerequisites needed to bypass Apple’s memory protections.Rosetta 2The script begins by disabling bash history logging and then checks if Rosetta 2, which allows Apple Silicon Macs to run x86_64 binaries, is installed.