Ransomware/Malware Activity
North Korean State-sponsored Threat Group Introduces
SpectralBlur Backdoor
A new backdoor for macOS has been discovered by security
researchers that appears to have coding similarities with a known
malware family known as KANDYKORN (SockRacket), an implant remote
access trojan used by North Korean state sponsored threat actors.
Known as SpectralBlur, it is a backdoor that can run shells, delete
files, sleep, etc. based on commands received from the threat
actor's C2 server infrastructure. TA444, also known as
BlueNoroff, is believed to be behind this campaign according to
Proofpoint threat researchers, as this is also the group that
deployed KANDYKORN against cryptocurrency exchanges in November of
last year. Proofpoint researcher Greg Lesnewich points out that
TA444 is continually creating new malware to target macOS users,
which is a stark difference to many other North Korean threat
actors that typically use recycled or off the shelf
