Sofacy’s ‘Komplex’ OS X Trojan

**Executive Summary:** Unit 42 describes 'Komplex', an OS X Trojan used by the Sofacy/APT28 actor to target aerospace-related individuals; Komplex uses a binder to drop a Mach-O dropper that installs a payload at /Users/Shared/.local/kextd with launchd persistence, communicates with C2 domains (appleupdate.org, apple-iclouds.net, itunes-helper.net and 185.10.58.170) via encrypted HTTP POSTs using a custom algorithm and 11-byte XOR string obfuscation, and shows code/infrastructure overlap with a Carberp variant and a MacKeeper-exploit campaign; the report supplies hashes and network IOCs for detection and blocking.