Mac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads
summary
Analysis shows the attackers implant a macOS backdoor called pool rat on the 3CX build machine, which surveys the host, decrypts hardcoded strings and fetches a second-stage binary called update agent; the trojanized installer hides malicious code inside a dependent library (lib FFM peg. diib) that runs via a constructor, decrypts config and C2 addresses, then downloads and executes the self‑deleting second stage. Detections that work: monitor unusual network C2, block non‑notarized processes, and flag self‑deleting binaries.
AI-written summary · about
chapters (7)
- 0:003CX supply chain intro
- 1:46Multi-stage attack chain
- 8:47Pool Rat backdoor on macOS
- 19:41Trojanized 3CX macOS installer
- 26:46Update Agent payload
- 33:28macOS malware detection
- 39:45Key takeaways
related talks
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
19mDeconstructing APT28's XAgent for OSX
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
32mA Case Study of MacOS Supply Chain Compromise
42mWho Let the Dogs Out? When PUPs Become BlackCat's Best Friend
52mLessons Learned from the Summer of Supply Chain Attacks
42mXZ Backdoor: Navigating The Complexities Of Supply Chain Attacks Detected By Accident