LightNews — News, ranked by scholars

Threadlinqs

@threadlinqs.bsky.social

DPRK's SpectralBlur hides as .macshare on macOS and shells out through a pty. https://intel.threadlinqs.com/threat/TL-2026-4894?utm_source=bluesky #ThreatIntel #SpectralBlur #KANDYKORN #RustBucket

October 31, 2026 at 9:32 AM

Threadlinqs

@threadlinqs.bsky.social

macOS stealers ruled 2024 - fake meeting apps and cracked software feeding crypto wallets to DPRK and MaaS crews. https://intel.threadlinqs.com/threat/TL-2026-4887?utm_source=bluesky #ThreatIntel #BeaverTail #SpectralBlur #DragonEgg

October 31, 2026 at 7:29 AM

PCI Guru

@jbhall56.bsky.social

The observed SpectralBlur sample was initially uploaded to VirusTotal in August 2023, but remained undetected by the antivirus engines and did not catch researchers’ attention until this week. www.securityweek.com/new-spectral...

New ‘SpectralBlur’ macOS Backdoor Linked to North Korea

SpectralBlur is a new macOS backdoor that shows similarities with North Korean hacking group’s KandyKorn malware.

www.securityweek.com

January 5, 2024 at 1:56 PM

InfoSec

@infosec.skyfleet.blue

Experts spotted a new macOS Backdoor named SpectralBlur linked to North Korea

Researchers discovered a macOS backdoor, called SpectralBlur, which shows similarities with a North Korean APT's malware family.

securityaffairs.com

January 6, 2024 at 6:54 PM

InfoSec

@infosec.skyfleet.blue

North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught

The post-exploitation backdoor is the latest in a string of custom tools aimed at spying on Apple users.

www.darkreading.com

January 5, 2024 at 8:09 PM

InfoSec

@infosec.skyfleet.blue

SpectralBlur: New macOS Backdoor Threat from North Korean Hackers

Cybersecurity experts unveil SpectralBlur, a new macOS backdoor with ties to North Korean malware.

thehackernews.com

January 5, 2024 at 4:13 PM

InfoSec

@infosec.skyfleet.blue

SpectralBlur macOS Backdoor Linked To North Korea

packetstormsecurity.com

January 5, 2024 at 2:39 PM

Greg Lesnewich

@greg-l.bsky.social

its also got a cousin we call SpectralBlur (which actually led us to find SockRacket in the first place) but that might have to wait for another thread

this was a fun find for me during a bonkers week - happy hunting!

an MD5 for being patient: e45394036e56637192bcc44d02bb00d9

November 30, 2024 at 9:31 AM

Greg Lesnewich

@greg-l.bsky.social

SpectralBlur does not share any Macho "similarities" with KandyKorn/SpectralBlur samples that we might use for easy pivoting

but these do prove useful still for linking KandyKorn/SpectralBlur samples together - certificate naming and dylibhashing are super consistent

November 29, 2024 at 10:49 PM

Greg Lesnewich

@greg-l.bsky.social

#100DaysofYARA day 03 - talking SpectralBlur, a MacOS (and other OS 🤫) backdoor linked to TA444/Bluenoroff, that I suspect is a cousin of the KandyKorn family our pals at Elastic found!

https://g-les.github.io/yara/2024/01/03/100DaysofYARA_SpectralBlur.html

November 29, 2024 at 9:05 PM

Retail & Hospitality ISAC

@rhisac.org

Cybersecurity researchers have discovered a new Apple macOS backdoor called SpectralBlur that overlaps with a known malware family that has been attributed to North Korean threat actors.

SpectralBlur: New macOS Backdoor Threat from North Korean Hackers

Cybersecurity experts unveil SpectralBlur, a new macOS backdoor with ties to North Korean malware.

thehackernews.com

January 8, 2024 at 2:42 PM

☁️Now🤖Breezing💨

@nowbreezing.ntw.app

Here's the Top 10 Trending Words over the Past 10 Minutes:
️⚠️🌀3 - beckenbauer
️⚠️🌀3 - franz
️⚠️🌀1 - kaiser
️⚠️🌀1 - bauern
5th - bowie
6th - copyright
7th - frieden
8th - openai
9th - 78
10th - probability
(tap or click a word to see all posts with that word!)

#ListenToBlackVoices #йобанарусня 🇺🇦

Word Cloud; its top words (sorted by weighted frequency, descending): beckenbauer, franz, kaiser, bauern, bowie, copyright, frieden, openai, 78, probability, trem, metropolis, gotham, gestorben, brexit, aniversário, traktoren, subsets, non-informative, mob, sg, rip, plagiarism, globes, gaza, distribution, 届い, すら, trecker, ruhe, neige, feierabend, copyrighted, bauer, ネタ, או, tod, theft, steel, principle, nearby, municipalization, monochrome, licensing, landwirtschaft, judges, ip, inevitable, indifference, hence, duolingo, distinguish, define, billionaire, bauernproteste, 避難, 載せ, 眠れ, 招待, テスト, コード, オタク, はじめ, だいぶ, שר, שלי, אז, таке, volk, uniform, traktor, speakers, snowing, snow, smash, s'il, resume, remotely, rayman, press, pointing, patients, oi, nvidia, notion, monday, maakt, llm, ie, idiots, identify, holocaust, heating, größten, generative, früh, froid, finance, domain, doku, denial, demonstrieren, cruel, construction, consistently, attacking, atomic, aha, aaaaaaaa, @jolandapikkaart.bsky.social, 55, 2006, 하코다테, 이게, 週間, 許さ, 絵描き, 楽しかっ, 描く, 抜き, 寝る, 向け, 公開, ブルー, ブル, フィード, バグ, スカイ, ぶる, びっくり, かい, お疲れ様, چشم, כן, כי, הוא, אם, אותי, אותה, şlap, zionism, zagallo, yt, yine, yessss, y'know, wütend, www.theguardian.com/technology/2, writes, winterthur, warming, vulnerable, vorhin, viaje, verlassen, types, tres, trainer, topics, theatre, temple, tat, switching, swing, sverige, sv, supports, submission, stronger, steal, siinä, sigh, shake, seeking, scraping, scientific, schlechter, schedule, ruim, revealed, returns, relate, protest, property, presented, poste, pitää, petits, paws, participation, parcel, parallel, owners, noir, negotiations, navigate, nao, nachher, mps, mort

Hashtag Cloud; its hashtags (sorted by weighted frequency, descending): #beckenbauer, #art, #nowplaying, #nsfw, #lowkey, #januarifotoflow, #홋카이도여행, #ukraine, #franzbeckenbauer, #ceasefirenow, #bauernproteste, #artist, #rip, #photography, #macos, #livresfr, #kaiser, #furryart, #fckafd, #digitalart, #defenddemocracyaidukraine, #artwork, #amwriting, #واژه_پاره_ها, #פידקאנטרי, #wealth, #warcrimes, #vtuber, #unjourunephoto, #trading, #teamlucas, #success, #spectralblur, #podcast, #pngtuber, #oc, #northkorea, #money, #modernclassicalmusic, #microplastics, #luxury, #landwirte, #kingdomhearts, #kandykorn, #invest, #illustration, #gold, #forex, #finance, #fcknzs, #entrepreneur, #climaterevolution41world, #classicalmusic, #ces2024, #business, #bitcoin, #beef, #bauern, #avgeek, #afdverbotsofort, #abdl

Emoji Cloud; its emojis (sorted by weighted frequency, descending): 🥶, 🔟, ❗, 🩶, ❎, ⚽, 🔵, 🐦‍⬛, ⬜, 🕯️, ⚪, 🪻, 🤬, 🙌🏼, ➕, ❄️, 🦊, 🥃, 🤦, 🤘🏻, 😱, 😪, 😡, 💅🏻, 👅, ©, 🪽, 🪄, 🩸, 🥁, 🕯, 🔪, 💩, 💡, 👿, 👍🏽, 👇🏿, 🐦, 🐉, 🎵, 🍞, ⚔️, ™️, 🫦, 🫤, 🥵, 🥀, 🤼, 🤷🏻‍♀️, 🤮, 🤩, 🤦🏻‍♂️, 🤤, 🤢, 🤟🏻, 🤞, 🤓, 🤍, 🟩, 🚬, 🚜, 🚖, 🙏🏻, 🙋‍♂️, 🙊, 🙇, 😰, 😩, 😟, 😞, 😕, 😔, 😈, 😂, 🗑️, 🗃️, 🖤, 🖖🏻, 🖖, 🖕, 🕊, 🔽, 🔥, 🔊, 📖, 📈, 💪🏻, 💣, 💢, 💓, 💐, 💎, 💀, 👹, 👏🏻, 👌, 👉, 🐾, 🐷, 🐱, 🐠, 🎼, 🎹, 🎸, 🎲, 🎈, 🍽️, 🍴, 🍓, 🌹, 🌱, 🌰, 🌡, 🌍, 🌆, 🈂, ⭐, ➡️, ✍🏻, ✍️, ✉️, ✈️, ⚒️, ☘️, ☃️, ▶️, ⏬

@bsky.app and the bsky.team have finally taken the first step. We must take the time to see how @safety.bsky.app fares and if the team will do the rest. #ListenToBlackVoices

January 8, 2024 at 4:50 PM

lazarusholic

@lazarusholic.bsky.social

"Analyzing DPRK's SpectralBlur" published by Objecive-see. #SpectralBlur, #BlueNoroff, #macOS, #CTI, #OSINT, #LAZARUS https://objective-see.org/blog/blog_0x78.html

January 5, 2024 at 12:30 PM

lazarusholic

@lazarusholic.bsky.social

"100DaysofYARA - SpectralBlur" published by GregLesewich. #KANDYKORN, #TA444, #YARA, #CTI, #OSINT, #LAZARUS https://g-les.github.io/yara/2024/01/03/100DaysofYARA_SpectralBlur.html

January 4, 2024 at 12:30 PM

johnpublic.bsky.social

@johnpublic.bsky.social

www.darkreading.com/threat-intel...

North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught

The post-exploitation backdoor is the latest in a string of custom tools aimed at spying on Apple users.

www.darkreading.com

January 6, 2024 at 9:49 PM

Bob Carver

@cybersecboardrm.bsky.social

This new macOS backdoor lets hackers take over your Mac remotely — how to stay safe tomsguide.com/news/this-ne... #CyberSecurity #macOS #SpectralBlur #KandyKorn #NorthKorea

January 8, 2024 at 4:40 PM

CyberTaters

@potato.software

This new macOS backdoor lets mashers take over your Mac remotely — how to stay safe tomsguide.com/news/this-ne... #PotatoSecurity #macOS #SpectralBlur #KandyKorn #NorthKorea

January 8, 2024 at 4:40 PM

jacquesdus.bsky.social

@jacquesdus.bsky.social

A new MacOS backdoor allowing hackers originating in North Korean and called Spectral Blur was recently discovered:

www.securityweek.com/new-spectral...

It seems to be able to evade detection from AntiVirus software.

#Cybersecurity #MacOS #NorthKorea

New ‘SpectralBlur’ macOS Backdoor Linked to North Korea

SpectralBlur is a new macOS backdoor that shows similarities with North Korean hacking group’s KandyKorn malware.

www.securityweek.com

January 8, 2024 at 9:11 AM

Ninja Owl

@ninjaowl.ai

SpectralBlur: New macOS Backdoor Threat from North Korean Hackers thehackernews.com/20... #cybersecurity #infosec #privacy #news

SpectralBlur: New macOS Backdoor Threat from North Korean Hackers

Cybersecurity experts unveil SpectralBlur, a new macOS backdoor with ties to North Korean malware.

thehackernews.com

January 5, 2024 at 8:18 PM

Mert SARICA

@hack4career.com

Analyzing DPRK's SpectralBlur

Mert SARICA on LinkedIn: Analyzing DPRK's SpectralBlur

Analyzing DPRK's SpectralBlur

www.linkedin.com

January 8, 2024 at 6:17 PM

YourAnonRiots 🐈‍⬛🏴🇵🇸🇲🇲🇺🇦🇸🇦🦋

@youranonriots.bsky.social

🛡️ Researchers uncover "#SpectralBlur," a new #macOS backdoor linked to North Korean hackers that can remotely control your system.
thehackernews.com/2024/01/spec...
#malware #hacking #cybersecurity