Loading malware…
RustBucket is a multi-stage macOS malware family attributed with high confidence to BlueNoroff, a North Korea-aligned subgroup associated with the Lazarus cluster and long-running financially motivated operations against cryptocurrency, fintech, venture capital, and related organizations. The campaign marked a notable expansion of BlueNoroff activity onto macOS and has been used in social-engineering operations that lure victims into opening a malicious application masquerading as a PDF viewer or related document-handling software.
Observed RustBucket infection chains use decoy PDF documents and fake PDF-reader applications to trigger staged execution. Early stages have included AppleScript applets and later Swift- or Objective-C-based components that decrypt configuration data, retrieve additional payloads, and execute them on the compromised host. Multiple variants have been documented, including loaders and droppers signed with valid Apple developer certificates later revoked, as well as universal Mach-O binaries supporting both Intel and Apple Silicon systems. Some variants require a specially crafted PDF to unlock malicious behavior, while others open a benign PDF as a distraction before downloading the next stage.
The final-stage RustBucket payload is a Rust-based backdoor that profiles the host, communicates with command-and-control infrastructure over HTTP POST, and can download and execute follow-on malware. Reported host reconnaissance includes collection of system version, hardware and boot information, time zone, running processes, and disk characteristics. Variants have shown anti-analysis and environmental-awareness features, including prior virtual-machine checks and obfuscated configuration handling. Later samples introduced persistence on macOS through LaunchAgents, while related BlueNoroff activity linked to RustBucket has also used shell-profile persistence via zsh environment files.
RustBucket has been associated with broader BlueNoroff tradecraft and infrastructure overlaps involving other macOS malware families and follow-on payloads, including ObjCShellz and activity assessed to intersect with KANDYKORN delivery chains. A Windows .NET variant using similar fake-PDF-reader themes and comparable staging logic has also been reported, indicating cross-platform development by the operator. Across reporting, RustBucket is consistently tied to credentialed social engineering and malware delivery aimed at financially valuable targets in the Web3 and cryptocurrency ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We recently discovered a new variety of malicious loader that targets macOS, presumably linked to the BlueNoroff APT gang and its ongoing campaign known as RustBucket.
Внутреннее имя проекта macOS RAT - macWebT - связывается с модулем webT из кампании RustBucket, атрибутированной BlueNoroff (подгруппа Lazarus).
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Bluenoroff’s observed initial intrusion vector includes phishing emails, as well as leveraging social networks such as LinkedIn.
Bluenoroff’s observed initial intrusion vector includes phishing emails, as well as leveraging social networks such as LinkedIn.
This campaign initially involved a first stage AppleScript applet... This retrieves a file... an AppleScript script that when executed posts the filepath of the executing process to a remote server.
The script contains three do shell script commands, which serve to download and execute the next stage.
Launching the LNK file results in downloading a Javascript file from Bluenoroff-controlled C2 server and executing it using mshta.exe... The downloaded file is an obfuscated Javascript.
The malicious PDF dropped a second-stage malware known as RUSTBUCKET... and in this instance persisted, via a Launch Agent disguised as “Safari Update”.
variant B contains a persistence mechanism that was not present in the earlier versions of RustBucket. This takes the form of a hardcoded LaunchAgent, which is written to disk at ~/Library/LaunchAgents/com.apple.systemupdate.plist .
If there is no antivirus, the DLL perform code injection on the provided explorer.exe process.
The malicious PDF dropped a second-stage malware known as RUSTBUCKET... and in this instance persisted, via a Launch Agent disguised as “Safari Update”.
variant B contains a persistence mechanism that was not present in the earlier versions of RustBucket. This takes the form of a hardcoded LaunchAgent, which is written to disk at ~/Library/LaunchAgents/com.apple.systemupdate.plist .
The downloaded file is an obfuscated Javascript: 5ca7c871dfe24b27b5cf7e9bf087f44c7620d78a1d4fa76373f22abedbdf8f82 The obfuscation method is straightforward and consists in encoding some characters in UTF-8 and Hex.
Earlier RustBucket versions spread its malicious payload via an app disguised as a PDF viewer. By contrast, this new variety was found inside a ZIP archive that contained a PDF file named, “Crypto-assets and their risks for financial stability”, with a thumbnail that showed a corresponding title page.
If there is no antivirus, the DLL perform code injection on the provided explorer.exe process.
The fake PDF reader uses a hardcoded 100-bytes XOR key to decrypt the new content of the document and the C2 server configuration... This script decodes its base64 block, writes it in a file 'tyrbz.js' and runs it.
It ad-hoc code-signs dropped payloads ( codesign --force --deep --sign - ) to bypass Gatekeeper.
Launching the LNK file results in downloading a Javascript file from Bluenoroff-controlled C2 server and executing it using mshta.exe.
If one of this antivirus is found, the DLL call the OpenProcess API to run the following command: rundll32.exe %s\DevExpress.Xpr.v19.2.dll,Update
This backdoor collects information about the compromised machine (name, active processes, network configuration, etc.) and sends this information to the C2 using POST requests.
This backdoor collects information about the compromised machine (name, active processes, network configuration, etc.) and sends this information to the C2 using POST requests.
This backdoor collects information about the compromised machine (name, active processes, network configuration, etc.) and sends this information to the C2 using POST requests.
The DoPost function is used to make the HTTP Post request to the C2 using libcurl.
162 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a Lazarus/BlueNoroff-linked campaign whose webT module resembles the macOS RAT naming seen in the axios incident.
macOS malware cited as using LaunchAgents/LaunchDaemons persistence mechanisms.
Referenced as part of attribution context linking the campaign to DPRK activity via the webT module; no direct operational role in this axios compromise is described beyond that linkage.
RustBucket is a fake PDF reader malware family used by Bluenoroff that targets macOS and Windows. It installs a backdoored but functional PDF reader, requires a specific decoy PDF to trigger execution, decrypts embedded configuration including the C2, downloads a follow-on payload, and deploys a backdoor that profiles the host, sends system information to C2, receives commands, and can load additional stages.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.