Huntress Uncovers LightSpy macOS Variant and Details Its Multi-Stage Implant

Apr 25, 2024 · Original article ↗

Summary

Huntress analyzed a LightSpy variant targeting macOS, detailing its dropper, implant, plugins, and command-and-control behavior. The researchers caution that the sample alone does not establish an active campaign.

Key points

The analyzed sample targets macOS, running on Intel devices or Apple Silicon with Rosetta 2; its binaries are compiled for x86_64.
The dropper downloads the core implant and plugins; its configuration is appended to the binary and AES-encrypted.
The implant uses a plugin manifest, decrypts payloads with a rolling XOR routine, and communicates with its C2 over WebSockets.
The researchers identified 10 additional payloads, including plugins for browser history, file management, keychains, screen recording, and shell commands.
Huntress published YARA and Sigma rules to help detect the loader, implant, and related macOS binaries.
The sample’s recent VirusTotal upload does not establish an active campaign or targeting in India; Huntress also found no evidence that the iOS version was present on the same C2.
Prior research has associated LightSpy with APT41, but Huntress made no attribution claim of its own.

Article Details

Attack Vectors: A dropper downloads and runs the core implant dylib, then downloads plugins from the C2 server.
The implant communicates with its C2 over WebSockets, sending heartbeats and receiving commands.
The macOS variant is compiled for x86_64 and runs on Intel Macs or Apple Silicon devices with Rosetta 2 enabled.
The implant’s listed plugins include functions for recording audio and the screen, capturing camera images, managing files and keychains, collecting browser history and Wi-Fi information, and running shell commands.
Defensive Notes: Huntress provides YARA rules for detecting the implant, loader, and dylibs, along with a Sigma rule.
The article recommends keeping devices updated and notes Apple protections including Lockdown Mode, TCC restrictions, XProtect, and XProtectRemediator.
The sample’s VirusTotal upload from India is not considered strong evidence of an active campaign or regional targeting.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]27[.]109[.]217`	Listed as the primary C2 for the macOS LightSpy variant.
SHA1	`0563225dcc2767357748d9f1f6ac2db9825d3cf3`	Hash of the LightSpy soundrecord plugin, identified as plugin ID 18000.
SHA1	`30e33f1188ca4cffc997260c9929738594e7488c`	Hash of the LightSpy ShellCommand plugin, identified as plugin ID 20000.
SHA1	`33c39728a0393d4271f27cc1d85cf3c1610be333`	Hash of the LightSpy cameramodule plugin, identified as plugin ID 19000.
SHA1	`476c726b58409a8e3e6cf8fb6bb7d46596917e24`	Hash of the LightSpy browser plugin, identified as plugin ID 14000.
SHA1	`7aceb8db03b8b8c7899982b5befcaf455a86fe0b`	Hash of the LightSpy LanDevices plugin, identified as plugin ID 33000.
SHA1	`8e7e8d896ed61bea7a49271e2e6ffc982942e5c7`	Hash of the LightSpy wifi plugin, identified as plugin ID 17000.
SHA1	`8f390335b571297a9eb605576745876666ee7f6a`	Hash of the LightSpy keychain plugin, identified as plugin ID 31000.
SHA1	`9a00f6ca0d9140316f9ae03f79c7511cec32849f`	Hash of the LightSpy FileManage plugin, identified as plugin ID 15000.
SHA1	`afd03337d1500d6af9bc447bd900df26786ea4a4`	Hash of the LightSpy macOS dropper (listed as SHA1 in the IOC table).
SHA1	`c65817a55b003462d48189875f18fa8bdb57b402`	Hash of the LightSpy softlist plugin, identified as plugin ID 16000.
SHA1	`e9ba5d2dd449678628834cf5a11cffe042a4f6d6`	Hash of the LightSpy ScreenRecorder plugin, identified as plugin ID 34000.
SHA1	`fd49866245721acc6e7431ec61b066696b72a1e1`	Hash listed for the LightSpy core implant.
SHA256	`0f66a4daba647486d2c9d838592cba298df2dbf38f2008b6571af8a562bc306c`	Hash of the LightSpy macOS second-stage implant.