A new backdoor for macOS has been discovered by security researchers that appears to have coding similarities with a known malware family known as KANDYKORN (SockRacket), an implant remote access trojan used by North Korean state sponsored threat actors. Known as SpectralBlur, it is a backdoor that can run shells, delete files, sleep, etc. based on commands received from the threat actor’s C2 server infrastructure. TA444, also known as BlueNoroff, is believed to be behind this campaign according to Proofpoint threat researchers, as this is also the group that deployed KANDYKORN against cryptocurrency exchanges in November of last year. Proofpoint researcher Greg Lesnewich points out that TA444 is continually creating new malware to target macOS users, which is a stark difference to many other North Korean threat actors that typically use recycled or off the shelf malware to accomplish their goals. TA444 has also been seen combining various pieces of malware together to avoid detection and create rapidly evolving new threats. This campaign further expands upon the desire by North Korean APT groups to target cryptocurrency exchanges and their users for financial gain. CTIX will continue to monitor the developments of DPRK threat actor groups and the malware they use and produce.