Executive Summary
The Lazarus Group has evolved its macOS tradecraft by deploying a 'fileless' loader known as unioncryptoupdater (part of the AppleJeus campaign). This malware is designed to establish persistence on macOS systems and beacon to a command-and-control (C2) server to retrieve encrypted 2nd-stage payloads that are executed entirely in memory, bypassing traditional disk-based forensics.
Technically, the loader leverages a modified version of the open-source 'osx_runbin' project to map Mach-O executables into memory via Apple APIs like NSCreateObjectFileImageFromMemory. The communication protocol uses Base64 encoding and AES-CBC encryption with a key derived from the system's serial number. This highlights the group's strategy of 'working smart' by integrating public offensive research into their custom toolsets.
This threat is significant due to its high stealth and the difficulty of capturing 2nd-stage payloads without advanced memory forensics. Organizations targeting cryptocurrency or financial assets should be particularly vigilant, as these are primary Lazarus objectives.