Between 2015 and 2017, offensive cyber-espionage tools belonging to several US intelligence agencies were leaked. This gave security researchers a unique opportunity to gain unparalleled insight into the tradecraft, tools, and capabilities of these secretive organizations.
Amongst these leaks were several macOS implants. One, Green Lambert, was leveraged by the Vault7 group (CIA), while another, DoubleFantasy, belonged to the EquationGroup (NSA).
Interestingly these implants did not receive much public attention, nor were they fully analyzed. This talk aims to rectify this by providing a comprehensive analysis of both. Analyzing these old samples, like cyber paleontologists, allows us to better understand the capabilities of their highly sophisticated creators.
Moreover, the malware analysis approaches we present in this talk are applicable to the study of any macOS malware specimen.