Uncovering North Korean APTs Targeting macOS Devices: A Deep Dive into Similarity Analysis of Mach-O Binaries and Linked Dynamic Libraries

In a groundbreaking presentation at LABScon 2023, Greg Lesnewich of Proofpoint delved into the world of North Korean APTs targeting macOS devices. With a focus on similarity analysis of Mach-O binaries and linked dynamic libraries, Lesnewich provided researchers with new techniques for hunting down these increasingly active threats.

While many state-aligned threats have explored macOS malware, North Korea has shown a particular dedication to compromising Apple’s desktop operating system for both espionage and financial gain. The world of macOS malware analysis is a complex and exciting space, with most discussions focusing on functionality and capability rather than how to find more similar samples. Analysts often rely on string searching, making the process more challenging compared to analyzing Windows executables.

Lesnewich’s talk introduced easy pivots for Mach-O files, using North Korean samples as a case study. He guided the audience through the North Korean clusters using Mach-O samples, illustrating how these clusters intersect and how their families relate to one another. By demonstrating simple pivots, Lesnewich showed how analysts can link a group’s families together more effectively.

Greg Lesnewich, a senior threat researcher at Proofpoint specializing in tracking malicious activity linked to North Korea, brought his expertise in threat intelligence and incident response to the presentation. With a background in building threat intelligence programs for Fortune 50 financial organizations, Lesnewich provided valuable insights into the world of North Korean cyber threats.

LABScon 2023, hosted by SentinelOne’s research arm, SentinelLabs, is a premier cybersecurity conference that brings together top minds in the field. The event offers an immersive experience for cybersecurity professionals to stay updated on the latest trends and techniques in the industry.

For those interested in staying informed about LABScon 2024 and future developments in cybersecurity, be sure to follow the latest updates from SentinelLabs.