OSX_OCEANLOTUS.D
OSX_OCEANLOTUS.D is a macOS backdoor identified by Trend Micro and assessed as a variant used by OceanLotus, also known as APT32, APT-C-00, SeaLotus, and Cobalt Kitty. The malware was delivered via a malicious Microsoft Word document themed as a Vietnamese event registration form and likely distributed by email. The lure document prompted users to enable obfuscated macros, which extracted and executed a Perl-based payload that dropped a Mach-O backdoor. The malware targeted macOS systems with Perl installed.
The dropper checked whether it was running as root and installed the backdoor accordingly. For root execution, it installed the payload as /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/screenassistantd; for regular-user execution, it installed it as ~/Library/Spelling/spellagentd. It hid the installed file, changed permissions to 755, and altered timestamps using the touch -t command. Persistence was established using com.apple.screen.assistantd.plist for root users or com.apple.spell.agent.plist for regular users, placed in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/ with RunAtLoad and KeepAlive keys, then loaded with launchctl. Additional reporting also notes creation of persistence files in /Library/LaunchAgents.
The malware disguised its true file structure as an application bundle by adding special characters to the filename and using the icon of legitimate Word documents. A variant has been observed packed with UPX.
The backdoor collected host identifiers and system information, including serial number, hardware UUID, MAC address, OS version, username, computer name, and architecture. It derived a clientID from environment data and a randomly generated UUID. Strings in the dropper and backdoor were encrypted with a hardcoded RSA256 key. For communications, the malware used AES256 and Base64-encoded or scrambled data, and has been described as scrambling and encrypting data before transmission. It used a custom binary protocol over TCP port 443, with zlib compression applied to data after offset 0x52. For network communications it loaded a .dylib via dlopen() and resolved functions with dlsym().
Documented backdoor capabilities include downloading and executing files, running terminal commands, transferring files, and deleting files from the system. Associated command-and-control servers reported in the source material are ssl.arkouthrie.com, s3.hiahornber.com, and widget.shoreoa.com.
The activity is linked to OceanLotus/APT32, which the source material associates with targeted attacks against human rights organizations, media organizations, research institutes, and maritime construction firms.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We identified a MacOS backdoor (detected by Trend Micro as OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus... The dropper is used to install the backdoor into the infected system and establish its persistence.
Techniques & procedures
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal.
The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
After deobfuscation, we can see that the payload is written in the Perl programming language. It extracts theme0.xml file from the Word document.
Astaroth uses the LoadLibraryExW() function to load additional modules. Attor's dispatcher can execute additional plugins by loading the respective DLLs. ... LightSpy's main executable and module .dylib binaries are loaded using ... dlopen() ... dlsym() ... RotaJakiro uses ... .so files ... using dlopen() and dlsym().
Persistence
3 techniques
Persistence
Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/ folder. The RunAtLoad key will command launchd to run the daemon when the operating system starts up... launchctl load ~/Library/LaunchAgents/ filename.plist
Privilege Escalation
3 techniques
Privilege Escalation
Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/ folder. The RunAtLoad key will command launchd to run the daemon when the operating system starts up... launchctl load ~/Library/LaunchAgents/ filename.plist
Stealth
7 techniques
Stealth
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
It extracts theme0.xml file from the Word document. theme0.xml is a Mach-O 32-bit executable... For root user path: /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ processname: screenassistantd For regular user path: ~/Library/Spelling/ processname: spellagentd
The app bundle is disguised as a doc file to trick users into executing it
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
Defense Impairment
1 technique
Defense Impairment
Discovery
4 techniques
Discovery
The content repeatedly describes actors and malware using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, netsh interface show, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, and network adapter/interface details.
Running getpwuid ->pw_name, scutil --get ComputerName, and uname –m will provide the following returns respectively: Mac OSX 10.12. System Administrator <owner’s name>'s iMac x86_64
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
Collection
1 technique
Collection
Command and Control
5 techniques
Command and Control
Some Backdoor.Oldrea samples use standard Base64 + bzip2... gh0st RAT has used Zlib to compress C2 communications data before encrypting it... HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.
infoClient is responsible for collecting OS info, submitting this info to its C&C servers... Communication with the C&C server after the exchange of OS packet info... HandlePP::urlRequest (/appleauth/static/cssj/N252394295/widget/auth/app.css)
The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
Like older versions of the OceanLotus backdoor, the new version contains two main functions: one for collecting operating system information and submitting this to its malicious C&C servers and receiving additional C&C communication information, and another for the backdoor capabilities.
Recent activity
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom macOS backdoor associated with OceanLotus/APT32, noted for multi-layered persistence.
macOS malware referenced as using LoginHook-based persistence on macOS.
macOS malware that uses the touch -t command to alter timestamps.
Software changes: ... OSX_OCEANLOTUS.D
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.