Loading malware…
KANDYKORN is a multi-stage macOS backdoor associated with North Korean Lazarus activity, particularly operations targeting blockchain engineers and cryptocurrency organizations. It has been observed in socially engineered intrusions in which attackers impersonate members of the blockchain community and lure victims into running a malicious application chain that ultimately deploys the implant in memory. Reported delivery has included Discord-based social engineering and lure content themed around cryptocurrency tooling.
The malware is typically delivered through several intermediate stages, including Python-based droppers and loader components such as SUGARLOADER and HLOADER. These stages retrieve encrypted configuration data, establish persistence, and reflectively load the final KANDYKORN payload without relying solely on a conventional on-disk executable. A notable persistence method in observed intrusions involved hijacking the execution flow of the legitimate Discord application on macOS. Related reporting also notes shell configuration hijacking as a fallback persistence mechanism in the broader campaign.
KANDYKORN communicates with command-and-control infrastructure using RC4-encrypted traffic and a custom handshake protocol. Once active, it can daemonize in the background and execute a broad set of backdoor functions. Documented capabilities include host reconnaissance, directory and file enumeration, upload and download of files, archiving and exfiltration of directories, secure file wiping, process listing and termination, remote command execution, interactive shell access, configuration retrieval and update, and sleep interval control. These features make it a fully featured post-compromise implant suited for long-term access and data theft.
The malware has been linked to campaigns overlapping with other DPRK macOS tooling, including RustBucket-related components and ObjCShellz, indicating component reuse and modular tradecraft across operations focused on the Web3 and cryptocurrency sector. KANDYKORN is best characterized as a sophisticated macOS backdoor used in targeted espionage and financially motivated intrusions against crypto-adjacent personnel and organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
KANDYKORN is a novel macOS backdoor recently discovered by Elastic Security Labs during an intrusion targeting blockchain engineers at a prominent crypto exchange platform.
Given this execution flow and SugarLoader’s historical role in retrieving the KANDYKORN malware, it is likely that the final payload in the chain would be KANDYKORN or another fully-featured backdoor.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Python scripts were used to drop malware that hijacked the host’s installed Discord app... Watcher.py checks the local Python version and downloads and executes testSpeed.py. The script downloads and executes another Python script, FinderTools.
SUGARLOADER uses this to retrieve and execute the KANDYKORN remote access trojan in-memory via NSCreateObjectFileImageFromMemory and NSLinkModule.
In the previous post, we analyzed how LaunchAgents work... LaunchAgents are great, but they have a flaw: macOS likes to scream about them with a “Background Items Added” notification... While their primary persistence was a LaunchAgent, they used shell configuration hijacking as a failsafe.
Today, I’ll talk about shell environment hijacking trick... The two most interesting files for us are: ~/.zshrc - executed for interactive shells... ~/.zshenv - executed for every instance of zsh... So, the main trick: we append a command to run our malware at the end of these files.
In the previous post, we analyzed how LaunchAgents work... LaunchAgents are great, but they have a flaw: macOS likes to scream about them with a “Background Items Added” notification... While their primary persistence was a LaunchAgent, they used shell configuration hijacking as a failsafe.
Today, I’ll talk about shell environment hijacking trick... The two most interesting files for us are: ~/.zshrc - executed for interactive shells... ~/.zshenv - executed for every instance of zsh... So, the main trick: we append a command to run our malware at the end of these files.
The victim believed they were installing an arbitrage bot, a software tool designed to profit from cryptocurrency rate differences between platforms.
Upon completion of the execution, the file is deleted to cover its tracks.
When the malware first connects to the C2 server during the initialization phase, a handshake must be validated to proceed.
resp_proc_list Lists all running processes on the system along with their PID, UID and other information.
resp_basicinfo Gathers information about the system such as hostname, uid, osinfo, and image path of the current process, and reports back to the server.
Operating covertly, KANDYKORN employs a feature-rich multi-staged loader paired with a custom network protocol to facilitate a range of post-compromise activities.
FinderTools is yet another dropper, downloading and executing a hidden second-stage payload (.sld) written to the /Users/Shared/ directory.
The main feature of CosmicDoor is that it communicates with the C2 server using the WSS protocol, and it provides remote control functionality such as receiving and executing commands... SneakMain... receives additional AppleScript commands and uses the osascript -e command to execute them.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A sophisticated macOS implant used by Lazarus Group against blockchain engineers, with shell configuration hijacking used as a fallback persistence mechanism to re-download or re-execute the loader if the primary LaunchAgent persistence was removed.
Referenced as a malware family leveraged in related BlueNoroff macOS-targeting campaigns; this content does not provide functional details beyond being delivered by SUGARLOADER in prior activity.
Referenced as a DPRK-linked malware/tool in a cited resource only; no behavioral details are provided in the content itself.
Malware used in a DPRK-linked campaign targeting blockchain engineers at a crypto exchange platform.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.