WAVESHAPERMalware
According to Mandiant, WAVESHAPER is a backdoor written in C++ and packed by an unknown packer that targets macOS. The backdoor supports downloading and executing arbitrary payloads retrieved from its command-and-control (C2 or C&C) server, which is provided via the command-line parameters.From MISP Galaxy
Last reported 6 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“Masquerading”
- T1055Process Injection
“Process Injection”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: JavaScript”
- T1059.004Unix Shell
“Command and Scripting Interpreter: Unix Shell”
- T1105Ingress Tool Transfer
“Ingress Tool Transfer”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Inside the Axios supply chain compromise - one RAT to rule them all“The macOS Mach-O binary delivered by the plain-crypto-js postinstall hook exhibits significant overlap with WAVESHAPER, a C++ backdoor tracked by Mandiant and attributed to UNC1069, a DPRK-linked threat cluster.”
Indicators in its reports
named in the reports above- sfrclak[.]comin 1 report
- packages.npm[.]orgin 1 report
- 142.11.206[.]73in 1 report
- 617b67a8e1210e4f…f583c900d101in 1 report
- 92ff08773995ebc8…071230c9645ain 1 report
- fcb81618bb15edfd…02bf980375cfin 1 report
- hxxp://sfrclak[.]com:8000/6202033in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.