MacOS_Components_Used_in_North_Korean_Crypto-Heists_MATAv5_Update.pdf (9 MB)

Proofpoint's LABScon talk examines North Korean macOS malware used in cryptocurrency theft and espionage operations. The source says DPRK-linked operators have invested heavily in Apple's desktop environment and uses Mach-O samples to show how related clusters and malware families can be connected. The hunting method centers on similarity analysis of Mach-O binaries and linked dynamic libraries, offering pivots beyond basic string searches for finding related samples.