NimDoor Strikes- DPRK’s Nim‑based macOS Malware Hits Crypto-Web3

Indicators of Compromise

Notes

<div class="content-body"> <span class="content-title">CONCLUSION</span> <p class="content-description">The NimDoor campaign marks a sophisticated leap in DPRK-linked cyber threats, employing a rare combination of Nim-based binaries, AppleScript backdoors, and encrypted WebSocket channels to target macOS users in the Web3 and crypto sectors. Its use of signal-based persistence, process injection, and stealthy data theft—covering browser credentials, Keychain secrets, and Telegram databases—demonstrates attackers’ evolving tactics.</p> <p class="content-description">For comprehensive detection and defense, platforms like <a href="https://socradar.io/">SOCRadar</a> offer valuable tools. Their Extended Threat Intelligence and IOC Radar can help monitor C2 domains, signal-based persistence indicators, and anomalous wss connections tied to NimDoor. Using SOCRadar, security teams can gain real-time visibility into targeted campaigns like this and stay ahead of emerging threats.</p> <p class="content-description">By combining EDR, YARA or SIEM rules, and threat intelligence from SOCRadar, organizations in the crypto/Web3 space can better detect, prevent, and respond to advanced macOS intrusions such as NimDoor.</p> </div>

Mitigation

<div class="content-container"> <p class="content-description"><span class="content-title">T1555.001 Credentials from Password Stores: Keychain</span></p> <div align="left"> <table> <colgroup> <col> <col> <col> </colgroup> <tbody> <tr> <th>ID</th> <th>Mitigation</th> <th>Description</th> </tr> <tr> <td><a href="https://attack.mitre.org/mitigations/M1027">M1027</a></td> <td><a href="https://attack.mitre.org/mitigations/M1027">Password Policies</a></td> <td>The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password.</td> </tr> </tbody> </table> </div> <p class="content-description"><span class="content-title">T1082 - System Information Discovery</span></p> <p class="content-description"><span class="content-title">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.</span></p> <p class="content-description"><span class="content-title">T1059.002 - AppleScript</span></p> <div align="left"> <table> <colgroup> <col> <col> <col> </colgroup> <tbody> <tr> <th>ID</th> <th>Mitigation</th> <th>Description</th> </tr> <tr> <td><a href="https://attack.mitre.org/mitigations/M1045">M1045</a></td> <td><a href="https://attack.mitre.org/mitigations/M1045">Code Signing</a></td> <td>Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing. This subjects AppleScript code to the same scrutiny as other .app files passing through Gatekeeper.</td> </tr> <tr> <td><a href="https://attack.mitre.org/mitigations/M1038">M1038</a></td> <td><a href="https://attack.mitre.org/mitigations/M1038">Execution Prevention</a></td> <td>Use application control where appropriate.</td> </tr> </tbody> </table> </div> <p class="content-description"><span class="content-title">T1005 - Data from Local System</span></p> <div align="left"> <table> <colgroup> <col> <col> <col> </colgroup> <tbody> <tr> <th>ID</th> <th>Mitigation</th> <th>Description</th> </tr> <tr> <td><a href="https://attack.mitre.org/mitigations/M1057">M1057</a></td> <td><a href="https://attack.mitre.org/mitigations/M1057">Data Loss Prevention</a></td> <td>Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.</td> </tr> </tbody> </table> </div> <p class="content-description"><span class="content-title">T1140 - Deobfuscate/Decode Files or Information</span></p> <p class="content-description"><span class="content-title">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.</span></p> <p class="content-description"><span class="content-title">T1055 - Process Injection</span></p> <div align="left"> <table> <colgroup> <col> <col> <col> </colgroup> <tbody> <tr> <th>ID</th> <th>Mitigation</th> <th>Description</th> </tr> <tr> <td><a href="https://attack.mitre.org/mitigations/M1040">M1040</a></td> <td><a href="https://attack.mitre.org/mitigations/M1040">Behavior Prevention on Endpoint</a></td> <td>Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection.</td> </tr> <tr> <td><a href="https://attack.mitre.org/mitigations/M1026">M1026</a></td> <td><a href="https://attack.mitre.org/mitigations/M1026">Privileged Account Management</a></td> <td>Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurity, and AppArmor.</td> </tr> </tbody> </table> </div> <p class="content-description"><span class="content-title">T1027.001 - Binary Padding</span></p> <p class="content-description"><span class="content-title">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.</span></p> <p class="content-description"><span class="content-title">T1087 - Account Discovery</span></p> <div align="left"> <table> <colgroup> <col> <col> <col> </colgroup> <tbody> <tr> <th>ID</th> <th>Mitigation</th> <th>Description</th> </tr> <tr> <td><a href="https://attack.mitre.org/mitigations/M1018">M1018</a></td> <td><a href="https://attack.mitre.org/mitigations/M1018">User Account Management</a></td> <td>Manage the creation, modification, use, and permissions associated to user accounts.</td> </tr> </tbody> </table> </div> </div>