Lazarus_Group__2019__Mac_Backdoor_Linked_to_Lazarus_Targets_Korean_Users.pdf

Trend Micro analysis identifies a Lazarus-linked Mac backdoor campaign using a macro-embedded Excel to lure Korean users and a decoy Album.app bundle (masquerading as Flash Player) that drops a hidden backdoor at ~/.FlashUpdateCheck and a LaunchAgents plist for persistence; the backdoor implements C2 communications with multiple domains and supports commands for host info, remote shell execution, file upload/download and configuration updates, with IoCs (file names and SHA256 hashes) provided.