HomeCryptoReplay of LABScon23: Analysis of macOS Components Utilized in North Korean Crypto-Heists

Replay of LABScon23: Analysis of macOS Components Utilized in North Korean Crypto-Heists

-


Uncovering North Korean APTs Targeting macOS Devices: A Deep Dive into Similarity Analysis of Mach-O Binaries and Linked Dynamic Libraries

In a groundbreaking presentation at LABScon 2023, Greg Lesnewich of Proofpoint delved into the world of North Korean APTs targeting macOS devices. With a focus on similarity analysis of Mach-O binaries and linked dynamic libraries, Lesnewich provided researchers with new techniques for hunting down these increasingly active threats.

While many state-aligned threats have explored macOS malware, North Korea has shown a particular dedication to compromising Apple’s desktop operating system for both espionage and financial gain. The world of macOS malware analysis is a complex and exciting space, with most discussions focusing on functionality and capability rather than how to find more similar samples. Analysts often rely on string searching, making the process more challenging compared to analyzing Windows executables.

Lesnewich’s talk introduced easy pivots for Mach-O files, using North Korean samples as a case study. He guided the audience through the North Korean clusters using Mach-O samples, illustrating how these clusters intersect and how their families relate to one another. By demonstrating simple pivots, Lesnewich showed how analysts can link a group’s families together more effectively.

Greg Lesnewich, a senior threat researcher at Proofpoint specializing in tracking malicious activity linked to North Korea, brought his expertise in threat intelligence and incident response to the presentation. With a background in building threat intelligence programs for Fortune 50 financial organizations, Lesnewich provided valuable insights into the world of North Korean cyber threats.

LABScon 2023, hosted by SentinelOne’s research arm, SentinelLabs, is a premier cybersecurity conference that brings together top minds in the field. The event offers an immersive experience for cybersecurity professionals to stay updated on the latest trends and techniques in the industry.

For those interested in staying informed about LABScon 2024 and future developments in cybersecurity, be sure to follow the latest updates from SentinelLabs.

LATEST POSTS

Expert Predicts the Era of Ethereum: Implications explained

Insights on the "Age of Ethereum" by Ryan Berckmans: A Game-Changer for Blockchain Technology? The Age of Ethereum: Prominent Investor Boldly Predicts Ethereum's Rise Amidst...

Rural Kentuckians continue to wait for noise relief as they look to Arkansas’ new crypto mining law – Kentucky Lantern

Noise Concerns and Regulation Challenges Surrounding Cryptocurrency Mining Operations in Rural Kentucky The quiet rural community of Wolfe County in Kentucky has been disrupted by...

Binance’s Key Move Puts AVAX and MATIC Under Pressure

Binance Delists AVAX and MATIC's TUSD Trading Pair: Price Pressure Expected Binance Delists AVAX and MATIC’s TUSD Trading Pair, Price Pressure Expected In a recent move...

Donald Trump scheduled to address Bitcoin conference

Trump to Speak at Bitcoin Conference in Nashville: Will Crypto Community Support Him in the Election? The upcoming Bitcoin Conference in Nashville, Tennessee is set...

Most Popular