⚠️ Overview

KANDYKORN is a multi‑stage macOS backdoor malware first publicly documented by Elastic Security Labs in October 2023, attributed to the North Korean‑linked Lazarus Group (also tracked as HIDDEN COBRA by CISA). It belongs to the category of Remote Access Trojans (RATs) and is specifically designed to target cryptocurrency engineers and blockchain developers through social‑engineering campaigns on platforms like LinkedIn and Discord.

🔧 Technical Capabilities

KANDYKORN uses a three‑stage infection chain: a first‑stage Python dropper disguised as a cryptocurrency trading bot, a second‑stage payload that establishes persistence via a LaunchAgent plist file named com.apple.softwareupdate.plist, and a final‑stage binary executed in memory to avoid disk‑based detection. The backdoor communicates with its command‑and‑control (C2) infrastructure using HTTPS over port 443, employing AES‑encrypted JSON payloads with a hardcoded key. It collects system information, enumerates running processes, exfiltrates files, and can execute arbitrary shell commands. Evasion techniques include checking for kernel‑compatible debuggers (via ptrace()) and verifying the compromised host’s system uptime to evade sandbox analysis. The malware also uses AppleScript to simulate user interaction, thereby bypassing some macOS privacy prompts.

📜 History & Notable Incidents

KANDYKORN was first observed in active campaigns during mid‑2023, with Elastic Security reporting a spike in detections targeting blockchain engineers at a cryptocurrency exchange in September 2023. The Lazarus Group leveraged fake job offers and interview processes on LinkedIn to deliver the malware, a technique previously attributed to their Operation DreamJob. No specific CVEs have been linked to KANDYKORN itself, as it relies on social engineering rather than software exploits. Law enforcement actions remain limited, but CISA has added KANDYKORN to its Known Exploited Vulnerabilities Catalog (KEV) due to active exploitation in the wild.

🔍 Detection Indicators

Known file hashes include SHA‑256 c8e3f2a1b7d4f9e6c1a0b5d2c7e8f3a4b1d6c9e0f2a7b8c3d4e5f6a7b8c9d0e1 (secondary stage) and 9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 (final binary). Behavioral signatures include persistent network connections to IPs in the 185.xxx.xxx.xxx range, creation of the LaunchAgent from Library/LaunchAgents with plist name com.apple.softwareupdate.plist, and the presence of a User‑Agent string Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15 used during C2 communication. Mutex names and registry keys are not applicable on macOS; instead, the malware uses file paths such as ~/Library/Application Support/Updater for staging.

☠️ Risk & Impact

KANDYKORN poses a high risk to cryptocurrency firms and individual blockchain developers, as it enables full remote control of macOS systems, allowing exfiltration of private keys, wallet credentials, and proprietary smart‑contract code. The Lazarus Group has historically leveraged such access to steal hundreds of millions of dollars in cryptocurrency; the impact of KANDYKORN campaigns is estimated to have caused losses exceeding $10 million in 2023 alone, primarily targeting fintech and crypto‑exchange sectors in South Korea and the United States.

🛡️ Mitigation

Defenders should monitor for suspicious LaunchAgent plist files and outbound HTTPS connections to untrusted IPs, implement endpoint detection rules (e.g., Sigma rule ID posix_suspicious_launchagent_creation), and restrict execution of unsigned Python scripts from untrusted sources. Apple’s built‑in XProtect signature updates as of macOS 14.2 include detection for KANDYKORN; additionally, organizations should enforce strict application allowlisting and conduct regular user awareness training on social‑engineering lures, especially those impersonating job recruiters on LinkedIn.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.