RustBucket
RustBucket is a multi-stage macOS backdoor/trojan attributed with strong confidence to BlueNoroff, a DPRK-linked subgroup associated with Lazarus. It targets macOS users, including victims in cryptocurrency and Web3-related operations, and has been described as marking BlueNoroff’s major pivot to macOS. The infection chain uses social engineering, including fake PDF viewer applications and malicious PDF lures such as job descriptions or protected/confidential documents. Stage 1 is a compiled AppleScript applet masquerading as a PDF viewer that downloads and executes Stage 2, often writing it to /Users/Shared/ including as /Users/Shared/.pd. Stage 2 has been observed in Swift and Objective-C variants for Intel, Apple silicon, and universal architectures; it requires a specially crafted PDF to unlock code that downloads and executes the Rust-based Stage 3 payload. The final-stage Rust backdoor gathers host information, including environmental and disk details, communicates with C2 using the User-Agent string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)," and can download and execute additional malware or attacker-supplied payloads. Reported capabilities include basic system information collection and file execution. Later variants added persistence via a LaunchAgent at ~/Library/LaunchAgents/com.apple.systemupdate.plist and copied the malware to ~/Library/Metadata/System Update; other reporting noted persistence disguised as "Safari Update" and C2 domain autoserverupdate[.]line[.]pm. Additional observed paths and artifacts include $TMPDIR/ErrorCheck.zip and residual/internal references to a webT module. RustBucket infrastructure, tooling, and tradecraft have been linked to later DPRK macOS activity including KandyKorn, GhostCall, and Hidden Risk, with researchers assessing overlap in infrastructure, file paths, strings such as "cur1-agent," and related components such as ObjCShellz and SysPhon.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malicious PDF dropped a second-stage malware known as RUSTBUCKET which is a backdoor written in Rust that supports file execution.
‘RustBucket’, as they labeled it, was attributed with strong confidence to the BlueNoroff APT... targeting macOS users with multi-stage malware that culminated in a Rust backdoor capable of downloading and executing further malware on infected devices.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Persistence
3 techniques
Persistence
The malicious PDF dropped a second-stage malware known as RUSTBUCKET... and in this instance persisted, via a Launch Agent disguised as “Safari Update”.
Privilege Escalation
3 techniques
Privilege Escalation
The malicious PDF dropped a second-stage malware known as RUSTBUCKET... and in this instance persisted, via a Launch Agent disguised as “Safari Update”.
Stealth
5 techniques
Stealth
The Stage 2 payload requires a specially-crafted PDF to unlock the code which would lead to the downloading of the Stage 3 and provide an XOR’d key to decode the obfuscated C2 appended to the end of the PDF.
It ad-hoc code-signs dropped payloads ( codesign --force --deep --sign - ) to bypass Gatekeeper.
Discovery
2 techniques
Discovery
Command and Control
3 techniques
Command and Control
The DoPost function is used to make the HTTP Post request to the C2 using libcurl.
IOCs tracked for this family
88 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
macOS malware cited as using LaunchAgents/LaunchDaemons persistence mechanisms.
Referenced as part of attribution context linking the campaign to DPRK activity via the webT module; no direct operational role in this axios compromise is described beyond that linkage.
Backdoor trojan (noted in 2023) that bypasses Gatekeeper via a fake PDF app and enables follow-on malware installation and espionage.
Referenced as an earlier campaign/malware associated with BlueNoroff's pivot to macOS targeting; also mentioned as having a 'lightweight version' called SysPhon.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.