NukeSped
NukeSped is a remote access trojan/backdoor widely associated with the North Korea-linked Lazarus Group and its subordinate clusters including BlueNoroff/TA444 and Andariel. Public reporting also notes overlap with the name Manuscrypt, and some sources explicitly prefer NukeSped as the public AV-recognized name. It has been observed against Windows and macOS targets, and reporting also describes broader NukeSped lineage malware and variants used by Lazarus since at least 2020.
Capabilities directly described in the source material include remote command execution, file operations, directory listing, drive enumeration, process execution, shell command execution, screenshot capture, keylogging, host reconnaissance, browser history retrieval, process snooping, SOCKS tunneling/port forwarding, configuration updates, and long-term surveillance/data theft. Specific modules named for some variants include ModuleUpdate, ModuleShell, ModuleFileManager, ModuleKeyLogger, ModuleSocksTunnel, ModuleScreenCapture, ModuleInformation, ModulePortForwarder, ModuleUsbDump, and ModuleWebCamera; USB dumping and webcam access were noted as newly observed features in one Log4Shell-related campaign. In one macOS AppleJeus-related case, the backdoor used libcurl APIs for C2 communications, established persistence via a LaunchAgent, and supported reconnaissance, arbitrary shell command execution, and file operations. In another Lazarus cryptocurrency campaign, a macOS updater downloaded encrypted payloads for in-memory execution using mmap and Apple APIs.
Infection and delivery vectors in the content include trojanized cryptocurrency trading applications and fake crypto tools, supply-chain compromises, exploitation of CVE-2021-44228 (Log4Shell) on unpatched VMware Horizon servers, vulnerable MS-SQL servers, and South Korean software distribution abuse. ASEC reported Lazarus distributing NukeSped in 2022 by exploiting Log4Shell on VMware Horizon, where PowerShell executed under ws_tomcatservice.exe to install the malware. ESET reported Lazarus supply-chain activity in South Korea in which multiple delivered tools were flagged as NukeSped. Reporting also tied a 2026 Axios npm compromise to a cross-platform RAT chain whose macOS component was detected as NukeSped/OSX/NukeSped-CB.
Targeting described in the content includes cryptocurrency companies, blockchain/Web3 and financial-sector victims, South Korean organizations, and broader espionage targets. Specific examples include a Brazilian cryptocurrency company, blockchain and cryptocurrency companies targeted with trojanized apps, and Korean targets compromised through VMware Horizon and software supply-chain abuse. The malware is repeatedly linked to Lazarus operations spanning espionage, financial theft, recon, data theft, and persistence.
Technical details from directly cited variants include C++ implementations with encrypted strings and encrypted C2 communications. One Lazarus-used variant used DES to decrypt internal strings and RC4 for C2 traffic; another described type used RC4 for strings, C2 lists, and communications. That campaign documented RC4 keys for string decryption (7B CA D5 7E 1B AE 26 D8 60 1B 61 DA 83 80 11 72 01 6C 54 D8 8A E8 DE 7B 1A 0A) and C2 communications (CD 80 5D D6 6C 1C 63 78 AF 13 7F 67 5B E9 B1 F4 87 27 EE 91 F3 5F 17 EE 9B 6A 28 61 8C F4). The same reporting described a C2 verification step mimicking SSL/HTTP traffic, including requests such as /index.php?member=sbi2009 and /member.php and expected HTTP 200 OK / SSL2.1-style responses, after which the malware sent the victim MAC address encrypted with RC4.
Indicators and infrastructure explicitly mentioned for NukeSped-related activity include the download URL hxxp://185.29.8[.]18/htroy.exe and C2 endpoints 185.29.8[.]18:8888, 84.38.133[.]145:443, 84.38.133[.]16:8443, and mail.usengineergroup[.]com:8443. In a macOS cryptocurrency lure campaign, NukeSped was reported beaconing to www.vinoymas.ch, sche-eg.org, and infodigitalnew.com. The malware has also been referenced by AV detections including Backdoor/OSX.Nukesped, OSX/TrojanDownloader.NukeSped.B, Trojan:MacOS/NukeSped.C!MTB, and OSX/NukeSped-CB.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Ahnlab Security Emergency response Center (ASEC) has recently confirmed that the 8220 Gang attack group is using the Log4Shell vulnerability to install CoinMiner in VMware Horizon servers. Log4Shell (CVE-2021-44228) is both a remote code execution vulnerability and the Java-based logging utility Log4j vulnerability... | ASEC has revealed attack cases where the Lazarus group used the vulnerability to spread NukeSped in 2022.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Antivirus Ahnlab Backdoor/OSX.Nukesped.20911661 ... ESET OSX/TrojanDownloader.NukeSped.B trojan ... Microsoft Security Essentials Trojan:MacOS/NukeSped.C!MTB
Hunt.io tied the attack to a Lazarus Group sub-cluster known as BlueNoroff, citing infrastructure overlaps and the RAT's similarities with NukeSped.
It also follows a new attack campaign orchestrated by the North Korea-linked Andariel group – another subordinate element within Lazarus – to deliver Black RAT, Lilith RAT, NukeSped, and TigerRAT by infiltrating vulnerable MS-SQL servers as well as via supply chain attacks using a South Korean asset management software.
Over the last 15 years, the group has developed RATs, including the following... ▪ NukeSped
Techniques & procedures
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
3 techniques"The Lazarus attackers... deliver Lazarus malware from a legitimate but compromised website."
"The Lazarus group developed custom malware and malware components."
"The attackers used illegally obtained code-signing certificates in order to sign the malware samples."
Initial Access
3 techniquesAndariel ... deliver Black RAT, Lilith RAT, NukeSped, and TigerRAT by infiltrating vulnerable MS-SQL servers
Cybersecurity researchers have discovered malicious code in an npm package ... The package in question is "@validate-sdk/v2" ... its real functionality is to plunder sensitive secrets from the compromised environment.
The npm account belonging to the library's primary maintainer, jasonsaayman, was compromised and used to push two malicious versions... published malicious axios@1.14.1 and axios@0.30.4.
Execution
3 techniquesOn macOS systems, victims are instructed to press Cmd (⌘) + Space, search for Terminal, and execute a series of commands. These commands retrieve and run multiple payloads, including two Mach-O binaries and Perl-based scripts on other occasions.
The macOS delivery uses AppleScript as an intermediate execution layer... launches it silently with nohup osascript.
Persistence
2 techniquesPrivilege Escalation
2 techniques"injects the Downloader into the matched service using reflective DLL injection" and "download, decrypt and execute other payloads in memory"
Stealth
5 techniques"The signed initial downloaders are Themida-protected binaries" and "This component is a Themida-protected file."
"The attackers camouflaged the Lazarus malware samples as legitimate software... similar filenames, icons and VERSIONINFO resources as legitimate South Korean software"
Security tools and EDR products that monitor for powershell.exe execution won't flag a process called wt.exe... value name "MicrosoftUpdate"... /Library/Caches/com.apple.act.mond.
Defense Impairment
3 techniques"...NukeSped lineage malware with registry-based configuration storage."
Gatekeeper Bypass: Removes macOS quarantine attributes using xattr -rc, allowing execution of untrusted files. Code Signing Evasion: Applies ad-hoc signatures to downloaded binaries using codesign to facilitate execution.
The key line is the codesign call: codesign --force --deep --sign - applies an ad-hoc code signature to the dropped binary... bypasses macOS Gatekeeper.
Discovery
3 techniquesThe first iteration sends the complete system profile, including a full process list from WMI... Linux RAT walks the /proc filesystem directly... macOS variant calls popen with "ps -eo user,pid,command".
It generates a random 16-character alphanumeric session UID... pulls a comprehensive system profile using WMI queries: hostname, username, full OS version with architecture, timezone, last boot time, OS install date, hardware model, and CPU type.
Command and Control
4 techniquesThe RAT communicates with its command-and-control (C2) server... C2 communication is driven by response codes: 20 → Download... 21 → Terminate execution. 22 → Keep-alive signal.
Single C2 at sfrclak.com:8000 (142.11.206.73) routes payloads by POST body... All C2 traffic goes through Python's http.client module... POST beacons on port 8000.
These initial payloads act as downloaders, retrieving additional malicious components... The second PowerShell script performs similar actions... it uses an HTTP GET request to retrieve another VBS payload.
"decrypts the server’s answer using the RC4 algorithm" and "uses the RC4 algorithm to encrypt its C&C communications"
Exfiltration
1 technique"The Lazarus malware exfiltrates data over the C&C channel."
IOCs tracked for this family
103 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan referenced as a malware family similar to the RAT used in the npm supply-chain compromise attributed to BlueNoroff.
A Mach-O remote access trojan observed as a second-stage payload on macOS in this campaign. It is identified as NukeSped and is described as commonly associated with Lazarus Group.
A cross-platform remote access/backdoor malware family tied in the content to the malicious npm supply-chain campaign. The operation deployed platform-specific RATs for macOS, Windows, and Linux that beaconed to a shared C2, collected host and process information, supported kill, peinject, runscript, and rundir commands, and on macOS used ad-hoc codesigning to bypass Gatekeeper.
A cross-platform remote access trojan deployed via the compromised Axios npm packages. It communicates with a C2 server to retrieve platform-specific second-stage payloads, attempts to remove installation artifacts, and replaces package metadata with a clean version to evade forensic detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.