Or KandyKorn
Lots of room in the market
Lots of room in the market
October 26, 2026 at 7:20 PM
Or KandyKorn
Lots of room in the market
Lots of room in the market
macOS in 2023: DPRK backdoors, LockBit ransomware and keychain stealers - behavior beats signatures. https://intel.threadlinqs.com/threat/TL-2026-4895?utm_source=bluesky #ThreatIntel #SmoothOperator #KANDYKORN #RustBucket
October 31, 2026 at 10:03 AM
macOS in 2023: DPRK backdoors, LockBit ransomware and keychain stealers - behavior beats signatures. https://intel.threadlinqs.com/threat/TL-2026-4895?utm_source=bluesky #ThreatIntel #SmoothOperator #KANDYKORN #RustBucket
DPRK's SpectralBlur hides as .macshare on macOS and shells out through a pty. https://intel.threadlinqs.com/threat/TL-2026-4894?utm_source=bluesky #ThreatIntel #SpectralBlur #KANDYKORN #RustBucket
October 31, 2026 at 9:32 AM
DPRK's SpectralBlur hides as .macshare on macOS and shells out through a pty. https://intel.threadlinqs.com/threat/TL-2026-4894?utm_source=bluesky #ThreatIntel #SpectralBlur #KANDYKORN #RustBucket
Never trust a man who likes candy corn no matter how it's spelled! 😆 #NormanBates #Psycho #KandyKorn #candycorn #AnthonyPerkins #TonyPerkins #BatesMotel
October 25, 2026 at 10:21 PM
Never trust a man who likes candy corn no matter how it's spelled! 😆 #NormanBates #Psycho #KandyKorn #candycorn #AnthonyPerkins #TonyPerkins #BatesMotel
No way half-brained ADHD geriatric keeps head long enuf to read single-spaced, insane, fangurl kandykorn.
August 21, 2026 at 2:01 AM
No way half-brained ADHD geriatric keeps head long enuf to read single-spaced, insane, fangurl kandykorn.
March 19, 2025 at 11:29 PM
February 28, 2025 at 1:23 PM
North Korea-affiliated Lazarus group targeting blockchain devs with novel macOS malware:
www.elastic.co/security-lab...
www.elastic.co/security-lab...
Elastic catches DPRK passing out KANDYKORN — Elastic Security Labs
Elastic Security Labs exposes an attempt by the DPRK to infect blockchain engineers with novel macOS malware.
www.elastic.co
November 1, 2023 at 9:50 AM
North Korea-affiliated Lazarus group targeting blockchain devs with novel macOS malware:
www.elastic.co/security-lab...
www.elastic.co/security-lab...
The observed SpectralBlur sample was initially uploaded to VirusTotal in August 2023, but remained undetected by the antivirus engines and did not catch researchers’ attention until this week. www.securityweek.com/new-spectral...
New ‘SpectralBlur’ macOS Backdoor Linked to North Korea
SpectralBlur is a new macOS backdoor that shows similarities with North Korean hacking group’s KandyKorn malware.
www.securityweek.com
January 5, 2024 at 1:56 PM
The observed SpectralBlur sample was initially uploaded to VirusTotal in August 2023, but remained undetected by the antivirus engines and did not catch researchers’ attention until this week. www.securityweek.com/new-spectral...
The attackers impersonate members of the cryptocurrency community on Discord channels to spread Python-based modules that trigger a multi-stage KandyKorn infection chain. www.bleepingcomputer.com/news/securit...
New macOS 'KandyKorn' malware targets cryptocurrency engineers
A new macOS malware dubbed 'KandyKorn' has been spotted in a campaign attributed to the North Korean Lazarus hacking group, targeting blockchain engineers of a cryptocurrency exchange platform.
www.bleepingcomputer.com
November 3, 2023 at 12:46 PM
The attackers impersonate members of the cryptocurrency community on Discord channels to spread Python-based modules that trigger a multi-stage KandyKorn infection chain. www.bleepingcomputer.com/news/securit...
North Korean hackers behind macOS malware strains such as RustBucket and KANDYKORN have been observed "mixing and matching" different elements of the two disparate attack chains - leveraging RustBucket droppers to deliver KANDYKORN
thehackernews.com/2023/11/n-ko...
thehackernews.com/2023/11/n-ko...
N. Korean Hackers 'Mixing' macOS Malware Tactics to Evade Detection
Lazarus Group's evolving cyber tactics target macOS systems by combining elements from multiple malware campaigns for better effectiveness and to avoi
thehackernews.com
December 3, 2023 at 5:18 AM
North Korean hackers behind macOS malware strains such as RustBucket and KANDYKORN have been observed "mixing and matching" different elements of the two disparate attack chains - leveraging RustBucket droppers to deliver KANDYKORN
thehackernews.com/2023/11/n-ko...
thehackernews.com/2023/11/n-ko...
Glad you made it, KandyKorn 💙
November 14, 2024 at 6:25 PM
Glad you made it, KandyKorn 💙
Лазарь атакует: новый вредоносный софт KandyKorn на macOS для блокчейн-инженеров
https://kripta.biz/posts/084885A0-5BBC-4230-BA6B-1C1B4702419D
https://kripta.biz/posts/084885A0-5BBC-4230-BA6B-1C1B4702419D
March 19, 2025 at 11:29 PM
Лазарь атакует: новый вредоносный софт KandyKorn на macOS для блокчейн-инженеров
https://kripta.biz/posts/084885A0-5BBC-4230-BA6B-1C1B4702419D
https://kripta.biz/posts/084885A0-5BBC-4230-BA6B-1C1B4702419D
Новый malware 'KandyKorn' для macOS нацелился на криптовалютных инженеров
https://kripta.biz/posts/B5142A8B-4B9C-4B65-BB7F-C704BD39A43B
https://kripta.biz/posts/B5142A8B-4B9C-4B65-BB7F-C704BD39A43B
February 28, 2025 at 1:23 PM
Новый malware 'KandyKorn' для macOS нацелился на криптовалютных инженеров
https://kripta.biz/posts/B5142A8B-4B9C-4B65-BB7F-C704BD39A43B
https://kripta.biz/posts/B5142A8B-4B9C-4B65-BB7F-C704BD39A43B
macOS Malware Mix & Match: North Korean APTs Stir Up Fresh Attacks
macOS Malware Mix & Match: North Korean APTs Stir Up Fresh Attacks
Lazarus and its cohorts are switching loaders and other code between RustBucket and KandyKorn MacOS malware to fool victims and researchers.
www.darkreading.com
November 28, 2023 at 5:43 PM
macOS Malware Mix & Match: North Korean APTs Stir Up Fresh Attacks
DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads
DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads - SentinelOne
Two apparently separate North Korean crypto theft campaigns targeting macOS users appear to be linked as threat actors mix and match droppers and payloads.
www.sentinelone.com
November 27, 2023 at 1:08 PM
DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads
New macOS 'KandyKorn' malware targets cryptocurrency engineers
New macOS 'KandyKorn' malware targets cryptocurrency engineers
A new macOS malware dubbed 'KandyKorn' has been spotted in a campaign attributed to the North Korean Lazarus hacking group, targeting blockchain engineers of a cryptocurrency exchange platform.
www.bleepingcomputer.com
November 2, 2023 at 7:35 PM
New macOS 'KandyKorn' malware targets cryptocurrency engineers
North Korean Hackers Tageting Crypto Experts with KANDYKORN macOS Malware
North Korean Hackers Tageting Crypto Experts with KANDYKORN macOS Malware
State-sponsored North Korean hackers are using a sneaky macOS malware called KANDYKORN to target crypto engineers via Discord.
thehackernews.com
November 1, 2023 at 9:35 AM
North Korean Hackers Tageting Crypto Experts with KANDYKORN macOS Malware
SpectralBlur does not share any Macho "similarities" with KandyKorn/SpectralBlur samples that we might use for easy pivoting
but these do prove useful still for linking KandyKorn/SpectralBlur samples together - certificate naming and dylibhashing are super consistent
but these do prove useful still for linking KandyKorn/SpectralBlur samples together - certificate naming and dylibhashing are super consistent
November 29, 2024 at 10:49 PM
SpectralBlur does not share any Macho "similarities" with KandyKorn/SpectralBlur samples that we might use for easy pivoting
but these do prove useful still for linking KandyKorn/SpectralBlur samples together - certificate naming and dylibhashing are super consistent
but these do prove useful still for linking KandyKorn/SpectralBlur samples together - certificate naming and dylibhashing are super consistent
#100DaysofYARA day 03 - talking SpectralBlur, a MacOS (and other OS 🤫) backdoor linked to TA444/Bluenoroff, that I suspect is a cousin of the KandyKorn family our pals at Elastic found!
https://g-les.github.io/yara/2024/01/03/100DaysofYARA_SpectralBlur.html
https://g-les.github.io/yara/2024/01/03/100DaysofYARA_SpectralBlur.html
November 29, 2024 at 9:05 PM
#100DaysofYARA day 03 - talking SpectralBlur, a MacOS (and other OS 🤫) backdoor linked to TA444/Bluenoroff, that I suspect is a cousin of the KandyKorn family our pals at Elastic found!
https://g-les.github.io/yara/2024/01/03/100DaysofYARA_SpectralBlur.html
https://g-les.github.io/yara/2024/01/03/100DaysofYARA_SpectralBlur.html