Sofacy’s ‘Komplex’ OS X Trojan
Summary: Unit 42 researchers identified a new OS X Trojan they track as 'Komplex,' attributed to the Sofacy group (also known as APT28, Pawn Storm, Fancy Bear, and Sednit), targeting individuals in the aerospace industry running OS X. The Trojan uses a binder that saves a decoy document named roskosmos_2015-2025.pdf - a 17-page Russian Federal Space Program document - and opens it in Preview while dropping a second Mach-O file to '/tmp/content', which installs a payload at '/Users/Shared/.local/kextd' and sets up persistence via launchctl.
Why it matters: Komplex shares an 11-byte XOR algorithm, the same variable names, and the identical C2 token 'h8sn3vq6kl' with Sofacy's Windows Carberp variant, meaning one actor can run the same command-and-control design across platforms - and its C2 domains apple-iclouds[.]net and itunes-helper[.]net were already tied to Sofacy phishing infrastructure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026