RustDoor
RustDoor is a Rust-based macOS backdoor, also tracked as ThiefBucket, that has been linked in reporting to North Korean activity, including BlueNoroff / Alluring Pisces / Sapphire Sleet-related campaigns. It has been used in social-engineering operations targeting cryptocurrency users, cryptocurrency-related businesses, and job-seeking software developers in the crypto sector, including LinkedIn recruiter lures, phishing emails with fake cryptocurrency-themed PDF content, and booby-trapped Visual Studio projects. Reporting also describes RustDoor as being delivered via trojanized applications and masquerading as legitimate software or software updates.
Observed behavior includes establishing backdoor access, stealing information, and downloading or executing additional payloads. In one reported campaign, initial execution attempted to download and run RustDoor Mach-O binaries at /Users/$USER$/.zsh_env and /Users/$USER$/Library/VisualStudioHelper from hxxps://apple-ads-metric[.]com/npm, then hide a file named "npm" with chflags hidden. RustDoor also attempted to steal data from the LastPass Chrome extension by archiving Local Extension Settings/aeblfdkhhhdcdjpifhhbdiojplfjncoa and attempted exfiltration to hxxps://visualstudiomacupdate[.]com/tasks/upload_file. The same activity downloaded bash scripts back.sh and sh.sh from apple-ads-metric[.]com intended to open a reverse shell; attempted reverse-shell traffic to 31.41.244[.]92:443 was blocked.
Separate reporting tied related DPRK-attributed macOS activity to RustDoor through code similarity and overlapping targeting. RustDoor has been associated with campaigns targeting cryptocurrency wallet data and host information, and one source notes a wallet targeting set including Ledger, Trezor, Bitcoin Core, Electrum, Exodus, Atomic, and Guarda. SentinelLABS assessed with high confidence that the actor behind the Hidden Risk campaign was the same actor responsible for earlier RustDoor / ThiefBucket and RustBucket activity. High-confidence indicators and infrastructure directly mentioned in the content include apple-ads-metric[.]com, visualstudiomacupdate[.]com, hxxps://apple-ads-metric[.]com/npm, hxxps://visualstudiomacupdate[.]com/tasks/upload_file, and 31.41.244[.]92.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We assess with high confidence that the same actor is responsible for earlier attacks attributed to BlueNoroff and the RustDoor/ThiefBucket and RustBucket campaigns.
“In this campaign, we discovered a Rust-based macOS malware nicknamed RustDoor masquerading as a legitimate software update…”
“In this campaign, we discovered a Rust-based macOS malware nicknamed RustDoor masquerading as a legitimate software update…”
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
3 techniques
Execution
The analysis of the script revealed an interesting and uncommon technique, namely to combine Python with Apple Scripting, as the filegrabber() function executes a large block of Apple script using the osascript -e command.
Credential Access
3 techniques
Credential Access
Collection
2 techniques
Collection
Command and Control
2 techniques
Command and Control
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a DPRK-attributed macOS malware whose crypto-wallet targeting list closely matches PHANTOMPULSE reconnaissance.
Rust-written macOS backdoor delivered via trojanized apps; described as linked to ransomware groups and designed to simplify cross-platform development.
Named malware family/campaign linked in the report to BlueNoroff-associated activity.
Rust-based macOS backdoor used in a fake job interview/Visual Studio project infection chain; downloads/executes Mach-O payloads, steals data (e.g., LastPass Chrome extension data), exfiltrates to C2, and downloads scripts intended to establish a reverse shell.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.