The New and Improved macOS Backdoor from Ocean Lotus
Summary: Unit 42 found a new OceanLotus macOS backdoor in its WildFire cloud analysis platform, targeted at victims in Vietnam and still showing extremely low AV detection almost a year after first discovery, with the command and control server reachable as recently as early June 2017. The backdoor ships as a zip containing a fake Word document that is actually an application bundle, launches a decoy password-protected Word file, sets up persistence via a Launch Agent, and communicates over a custom binary protocol on TCP port 443 using bit shifting, XOR, and AES-CBC with ephemeral server-supplied keys.
Key Takeaway: The malware uses a custom binary protocol on port 443, a port traditional firewalls are unlikely to block, and its strings are encoded with a variable-key routine rather than the old XOR scheme, so basic static analysis and port-based controls both miss it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026