New Loki Backdoor Attacking macOS Systems

Cody Thomas developed Apfell, an open-source macOS post-exploitation framework, in 2018 and evolved into Mythic, a cross-platform framework that addresses the limitations of existing tools. 

Mythic provides a unified interface for managing agents written in various languages for different platforms, which allows for flexibility and customization, enabling the creation of agents with specific functionalities. 

Currently, the official Mythic repository houses over two dozen agents, where the Loki agent employs a modified djb2 hashing algorithm to obscure API functions and commands, which involves using a different magic number (2231) compared to the original Havoc agent. 

The hash value is calculated by iterating through the string, shifting the value left by 5 bits, adding the original hash value, and then adding the current character, which makes it more difficult to analyze and identify the agent’s behavior.

The Loki loader, a piece of malware, sends encrypted information about the infected system to a command-and-control server.

In response, the server sends a DLL that the loader loads into the infected device’s memory, which handles further communication with the server. 

Both the May and July versions of the loader use similar encryption methods but have minor differences in data serialization and UUID handling. 

The May version sends a plaintext UUID, while the July version encodes it. After the initial connection, the loader transfers control to the DLL, which continues the malicious activity.

The analyzed malware, stagger_1.1.dll, is a Windows x64 executable based on the Havoc agent, which communicates with a C2 server using a series of hashed commands, including file transfer, process management, and environment manipulation. 

The agent does not support traffic tunneling natively, but attackers frequently use third-party tools like ngrok or gTunnel to access private networks, which was observed being loaded and executed in memory to avoid detection.

According to Securelist, Russian companies in various industries have been targeted by a sophisticated malware campaign, likely delivered via email attachments, where the attackers, using publicly available tools, have successfully compromised over a dozen organizations. 

Victims are believed to have been tricked into opening malicious files, leading to the installation of the Loki malware.

Despite extensive research, attribution to a specific threat actor remains challenging due to the attackers’ evasive tactics and use of common tools.

The popularity of open-source post-exploitation frameworks has grown, with attackers increasingly using them to control and modify victim devices remotely.

These frameworks, like July and May loaders, often employ techniques that evade detection and attribution. 

Specific file hashes, network traffic patterns, and command-and-control (C2) addresses associated with these frameworks are indicators of compromise.

The main module, gTunnel, and ngrok are key components used for tunneling and establishing communication with the attacker.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar