LABScon23 Replay | macOS Components Used in North Korean Crypto-Heists

In this unique talk, Proofpoint’s Greg Lesnewich takes us on a tour of recent North Korean APTs targeting macOS devices and offers researchers new techniques for hunting this increasingly active cluster through similarity analysis of Mach-O binaries and linked dynamic libraries.

While many state-aligned threats have dipped their toes into macOS Malware, North Korea has invested serious time and effort into compromising Apple’s desktop operating system. Its operations in macOS environments include both espionage and financial gain. macOS malware analysis …

analysis apts cluster components crypto devices dynamic hunting libraries mach macos malware analysis north north korean proofpoint replay researchers similarity state targeting techniques threats tour