Deconstructing APT28's XAgent for OSX
summary
APT28's macOS implant is a full-featured backdoor (xAgent v3) delivered by a 3-stage spearphish PDF→downloader→payload chain and calls home to hard-coded domains/IPs. Network traffic uses RC4 + base64 with a 54‑byte RC4 key (50 bytes hard-coded + 4-byte per-message suffix) and URL tokens for victim ID. Capabilities include keylogging, Firefox credential theft via logins.json + NSS decryption, AppleScript-based code injection (matches leaked HackingTeam code), FTP exfiltration and screenshots every 10s resized to 800×500, plus iOS backup theft.
AI-written summary · about
chapters (8)
- 0:00Introduction to APT28
- 1:29APT28 attack overview
- 3:59XAgent communication analysis
- 8:54Spying modules capabilities
- 13:51Data exfiltration methods
- 16:02Code reuse from Hacking Team
- 17:27Comparison with other platforms
- 18:32Summary and conclusion
related talks
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
32mHow Things Are Going For APT41 In 2024
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
32mDissecting FINALDRAFT: Actionable Intel from a State-Sponsored Multi-Platform Backdoor