Loading malware…
XSLCmd is a backdoor malware family associated with the China-linked espionage group GREF and documented in both Windows and Apple OS X variants. The OS X variant, publicly reported in 2014, was adapted from the Windows codebase and was designed to compromise Mac systems for long-term intelligence collection. On infected hosts it establishes persistence through Launch Agent mechanisms and supports reverse shell access, file system access, file transfer, installation of additional malware, keystroke logging, and screenshot capture. The malware also performs operating-system version checks before fully executing.
XSLCmd has been linked to targeted cyber-espionage operations rather than broad criminal distribution. GREF has historically used the malware in campaigns against organizations including the U.S. defense industrial base, electronics and engineering firms, and foundations and NGOs with interests in Asia. Delivery has been associated primarily with watering-hole compromises and, less frequently, phishing. GREF has also been tied to exploitation of browser and browser plug-in vulnerabilities in support of intrusion activity. XSLCmd is notable as an early example of a state-linked threat actor porting established espionage tooling to OS X as Mac adoption increased in enterprise and policy-relevant environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Security Experts at FireEye Lab discovered a new variant of the XSLCmd backdoor that has been used in targeted attacks infecting Mac OX based systems.
Security Experts at FireEye Lab discovered a new variant of the XSLCmd backdoor that has been used in targeted attacks infecting Mac OX based systems.
Security Experts at FireEye Lab discovered a new variant of the XSLCmd backdoor that has been used in targeted attacks infecting Mac OX based systems.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For instance, one of the PlayfullDragon’s Xslcmd backdoors described by our colleagues from FireEye ... beams to cdi.indiadigest[.]in:53.
For instance, one of the PlayfullDragon’s Xslcmd backdoors described by our colleagues from FireEye ... beams to cdi.indiadigest[.]in:53.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
The GREF used mainly watering hole attacks to serve the backdoor ... FireEye confirmed that GREF APT has used zero-day exploit in the past to infect victims through the exploitation of vulnerabilities in browsers or browser plug-ins like Flash Player, Adobe Reader and Java.
The XSLCmd backdoor and is capable of opening a reverse shell, accessing victims file system, transferring files and installing additional malware on the infected PC, logging keystrokes and capturing screen shots.
FireEye confirmed that GREF APT has used zero-day exploit in the past to infect victims through the exploitation of vulnerabilities in browsers or browser plug-ins like Flash Player, Adobe Reader and Java. GREF was particularly active in the 2010 then it used different 0-day exploits, including CVE-2010-0806, CVE-2010-1297 and CVE-2010-2884 in its attacks.
Several references discuss command-and-control infrastructure and backdoors, including 'Attacks on East Asia using Google Code for Command and Control' and GitHub abuse for C2 communications.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
OS X backdoor mentioned as part of the attribution chain connecting DoubleAgent to the GREF threat group.
Backdoor associated with PlayfullDragon/GREF, mentioned because of infrastructure overlap with Hellsing activity.
A backdoor used in targeted cyber espionage attacks. The OS X variant copies itself for persistence and can open a reverse shell, access the victim file system, transfer files, install additional malware, log keystrokes, and capture screenshots.
Mac Malware of 2016 ... XSLCmd
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.