MacProStorage:_2017Final:Bitdefender-Whitepaper-APT-Mac-A4-en_EN:Bitdefender-Whitepaper-APT-Mac-A4-en_EN.indd

Bitdefender dissects an APT28 (Sofacy) Mac OS X backdoor (XAgent) delivered via the Komplex binder/dropper: the report details initialization, persistence, RC4+base64 HTTP GET/POST C2 communication, hardcoded C2 domains/IPs and a command set, and modular espionage functionality (keylogger, screenshots, remote shell, file exfiltration including iOS backups). The paper provides code excerpts, module descriptions, IOCs and mapping to other platform variants, highlighting a sophisticated nation-state-grade malware campaign targeting macOS.