# The DPRK strikes using a new variant of RUSTBUCKET

New RUSTBUCKET macOS variant adds LaunchAgent persistence and UA-gated C2 staging, used against a US crypto payment provider by DPRK actors.

- Payout: Real-world hack
- Severity: high
- Program: RUSTBUCKET
- Analysis by: Salim Bitam, Ricardo Ungureanu, Colson Wilhoit, Seth Goodwin, Andrew Pease
- Disclosed: 2023-07-14
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/DPRK-strikes-using-a-new-variant-of-rustbucket
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dprk-strikes-using-a-new-variant-of-rustbucket
- Tags: area:os domain:desktop impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:curl technique:recon technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** macOS endpoint (osascript, LaunchAgents, Mach-O payloads)
**Root cause:** Three-stage macOS implant: osascript/curl downloads a Swift stager that fetches a Rust FAT binary; the new variant writes a com.apple.systemupdate.plist LaunchAgent pointing at a copied binary in ~/Library/Metadata to persist across logins.
**Steps:**
1. Stage 1: AppleScript via `/usr/bin/osascript` runs curl with User-Agent `cur1-agent` and body string `pd`, saving Stage 2 to `/users/shared/.pd`
2. Stage 2 (Swift) POSTs with UA `mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)` and body `pw` to C2 URL passed as argv[1]
3. Stage 2 writes Stage 3 to `$TMPDIR/<NSUUID>` and executes it via NSTask
4. Stage 3 (Rust FAT binary) generates 16-byte ID, collects hostname/processes/timestamps/boot time, POSTs to C2
5. C2 returns command ID: `0x31` self-terminate, `0x30` upload Mach-O/shell payload to `$TMPDIR/.<8 random digits>`, chmod +x, execute, report status, sleep 60s, loop
6. Persistence: write `/Users/<user>/Library/LaunchAgents/com.apple.systemupdate.plist` with RunAtLoad/KeepAlive/LaunchOnlyOnce and ProgramArguments pointing to `/Users/<user>/Library/Metadata/System Update` with C2 `https://webhostwatto.work.gd`
**How found:** Code similarity search on a telemetry sample led to VirusTotal, surfacing an undetected variant; reversing revealed the new plist persistence and C2 infrastructure, then TLS fingerprint pivoting clustered sibling domains.
**Exploitation:** Operators stage payloads behind UA checks (wrong UA yields 405), rotate C2 domains after researcher collection, and use the LaunchAgent to relaunch the implant at every user login with the C2 URL as argument, maintaining long-term access to the crypto payment provider.
**Escalation:** Persistence via LaunchAgent plus operator-supplied arbitrary Mach-O/shell execution (command 0x30) allows post-compromise tooling deployment and lateral movement.
**Insight:** Malware C2 staging often gates payload delivery on exact User-Agent strings (note typosquats like `cur1-agent` and all-lowercase fake Firefox UA) — replay the observed UA verbatim when collecting samples, and pivot on TLS leaf cert fingerprints to cluster rotating C2 domains.

## Proof of concept (copied exactly from the original report)

**EQL query for osascript curl download**

```
process where process.parent.name : "osascript" and process.name : "curl" and process.args : "-o"
```

**EQL query for self-signed binary with URL**

```
process where event.type == "start" and event.action == "exec" and 
 process.code_signature.trusted == false and 
 process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and 
 process.args : "http*" and process.args_count <= 3
```