Sofacy’s ‘Komplex’ OS X Trojan - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 details 'Komplex', an OS X Trojan attributed to Sofacy (APT28) that uses a binder to drop a Mach-O dropper and payload, establishes persistence via a LaunchAgent plist and start script, communicates with encrypted C2 servers using an 11-byte XOR scheme, and contains IOCs (hashes and C2 domains) with links to a MacKeeper-based exploit and overlaps with Sofacy's Carberp tooling.