North Korean state-backed hackers have launched a sophisticated campaign using a new macOS malware family called NimDoor, specifically targeting web3 and cryptocurrency organizations. Security researchers have identified this as one of the most complex macOS malware operations linked to North Korean threat actors.
## Attack Method and Initial Compromise
The attack begins with social engineering tactics where hackers contact victims through Telegram, convincing them to install what appears to be a legitimate Zoom SDK update. The malicious payload is delivered through Calendly invitations and email communications, closely resembling previous campaigns attributed to the BlueNoroff group.
## Technical Architecture of NimDoor
SentinelOne researchers discovered that the malware uses an unusual combination of C++ and Nim-compiled binaries, making it stand out from typical macOS threats. The framework operates through three main components:
**Installer Component**: Handles initial system setup, creates necessary directories, and deploys two additional binaries – ‘GoogIe LLC’ and ‘CoreKitAgent’ – onto the victim’s machine.
**GoogIe LLC**: Collects environmental data and generates encoded configuration files. It establishes persistence by creating a macOS LaunchAgent that automatically restarts the malware during system login while storing authentication keys for subsequent attack stages.
**CoreKitAgent**: The most sophisticated element, functioning as an event-driven binary that uses macOS’s kqueue mechanism for asynchronous operations. It features a 10-case state machine with flexible control flow capabilities.
## Revolutionary Persistence Mechanism
The malware’s most distinctive feature is its signal-based persistence system. CoreKitAgent installs custom handlers for SIGINT and SIGTERM signals – typically used to terminate processes. When these termination signals are detected, the malware automatically triggers a reinstallation routine, redeploying all components and restoring the persistence chain.
This innovative approach ensures that attempts to manually terminate the malware actually result in its reinstallation, making it highly resistant to basic defensive measures.
## Data Theft Capabilities
The malware operates multiple data exfiltration channels simultaneously:
– **System Monitoring**: CoreKitAgent executes encoded AppleScript that contacts attacker infrastructure every 30 seconds, transmitting system data and executing remote commands
– **Browser Data Theft**: The ‘upl’ script extracts information from web browsers, Keychain passwords, and command history files
– **Telegram Targeting**: The ‘tlgrm’ script specifically targets Telegram databases and encryption keys, potentially allowing attackers to decrypt private messages
## Advanced Evasion Techniques
Researchers noted sophisticated obfuscation methods, including one script containing over 10,000 blank lines to evade detection systems. The malware also establishes WebSocket-based command and control communications for additional stealth.
## Significance and Implications
This campaign represents a significant evolution in North Korean cyber capabilities, demonstrating advanced cross-platform malware development skills. The modular design and novel persistence mechanisms indicate that DPRK operators are continuously enhancing their toolkit to target cryptocurrency assets and sensitive information more effectively.
Security experts emphasize that organizations in the cryptocurrency and web3 sectors should implement enhanced security measures and remain vigilant against sophisticated social engineering attacks, particularly those involving fake software updates delivered through trusted communication platforms.