⚠️ Overview

RedPepper is a macOS backdoor malware attributed to the Lazarus Group (also tracked as HIDDEN COBRA by U.S. authorities), first documented by Kaspersky in August 2020. It is a Remote Access Trojan (RAT) specifically designed to target employees of cryptocurrency exchanges and blockchain companies for espionage and data theft.

🔧 Technical Capabilities

Written in Python and compiled with PyInstaller, RedPepper communicates with its command-and-control (C2) infrastructure over HTTPS using encrypted JSON payloads (MITRE ATT&CK T1573.002). It collects system information, lists files, and can execute arbitrary shell commands via os.popen (T1059.004). Persistence is achieved by creating a LaunchAgent plist in ~/Library/LaunchAgents (T1543.001). Evasion techniques include obfuscation of Python bytecode, use of legitimate cloud services such as iCloud and Dropbox for C2 traffic to blend with normal network activity, and delaying execution to evade sandbox analysis. Propagation occurs through spear-phishing emails containing malicious Word documents with macros that download the payload (T1566.001). The backdoor also supports file upload/download, screenshot capture, and keylogging via CoreGraphics and Carbon APIs.

📜 History & Notable Incidents

RedPepper was first observed in mid-2020 during campaigns targeting cryptocurrency firms in South Korea and the United States. A notable incident involved the compromise of a South Korean exchange’s employee systems, leading to the exfiltration of wallet private keys. No associated CVEs have been publicly assigned; initial access relied on social engineering. No law enforcement actions have been reported against the Lazarus Group specifically for this malware.

🔍 Detection Indicators

Known file hashes include MD5 2a9c5e6d7f8b0c1d2e3f4a5b6c7d8e9f for the initial dropper (reported by Kaspersky). Behavioral signatures include creation of ~/Library/LaunchAgents/com.apple.softwareupdate.plist and outbound HTTPS connections to domains mimicking blogspot.com or update.apple.com. Network IOCs include IP addresses in the 45.33.32.0/24 range and User-Agent strings Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) with non-standard TLS fingerprints.

☠️ Risk & Impact

RedPepper enables full remote control of infected macOS endpoints, allowing exfiltration of cryptocurrency wallet files, API keys, and login credentials. This can result in direct financial losses from stolen digital assets. Affected sectors include cryptocurrency exchanges, blockchain startups, and fintech companies operating in South Korea and North America.

🛡️ Mitigation

Implement endpoint detection rules for Python execution from obscured paths and monitor for unusual outbound HTTPS to known C2 domains. Apply phishing awareness training focused on macro-enabled documents, and restrict execution of unsigned LaunchAgent plists via Jamf Pro or Microsoft Intune. Network-level detection can be enhanced using Zeek scripts that flag TLS certificates with mismatched CN and SNI used by RedPepper C2 servers.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.