Skip to content

OSX_OCEANLOTUS.D

Software · ATTACK:enterprise:S0352

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0352",
  "title": "OSX_OCEANLOTUS.D",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0352",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--b00f90b6-c75c-4bfd-b813-ca9e6c9ebf29",
  "external_id": "S0352",
  "domain": "enterprise",
  "created": "2019-01-30T19:18:19.667Z",
  "modified": "2024-04-11T00:28:52.310Z",
  "version": "3.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Backdoor.MacOS.OCEANLOTUS.F"
    },
    {
      "source_name": "OSX_OCEANLOTUS.D"
    },
    {
      "source_name": "Unit42 OceanLotus 2017",
      "url": "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"
    },
    {
      "source_name": "TrendMicro MacOS April 2018",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/"
    },
    {
      "source_name": "Trend Micro MacOS Backdoor November 2020",
      "url": "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html"
    }
  ]
}

Explicit source assertions (29)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0112eb25-7f6c-49cd-95c8-bf0d49f7c380

TrendMicro MacOS April 2018

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04610729-6f83-48d4-9f5b-1c1c4a39df3a

Unit42 OceanLotus 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1222.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d40b95c-629c-46bf-bafc-2558a180fedc

sentinelone apt32 macOS backdoor 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--207c59d5-9df0-4838-9a0a-5555ea78b35f

Unit42 OceanLotus 2017 · TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22067fc3-6919-41b5-b506-4a00830af5c4

TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f921bea-899f-4b13-94b2-13f7a4813b8b

ESET OceanLotus macOS April 2019 · Unit42 OceanLotus 2017 · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47b5c142-c0e5-4754-ae7f-b95bf01d3a5b

Unit42 OceanLotus 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ca73e82-4e56-4044-a21a-d613a80f171c

Unit42 OceanLotus 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f9fef8b-1ceb-4a10-b6ea-ff2a9680154f

Trend Micro MacOS Backdoor November 2020 · sentinelone apt32 macOS backdoor 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0352

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56f587e1-d7c3-4489-945e-58c4ee3e4ba7

TrendMicro MacOS April 2018 · Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--588865e4-caec-4150-9c03-df5e28eb9c79

TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020 · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a34e6af-f5e1-4191-aec0-06a92201f414

Unit42 OceanLotus 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1543.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a872d22-22e6-49b1-8ddd-7efc6c403ad6

TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cb54f4b-f615-44ad-94d6-136ff507c2d6

TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60bab055-6927-4240-8716-6218dc131aa9

TrendMicro MacOS April 2018

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60fa966f-bb77-481f-9541-8a14e965718a

TrendMicro MacOS April 2018

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--630ef5c5-438d-4681-b4e9-b9dee3934848

Trend Micro MacOS Backdoor November 2020 · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c2e3490-d5d7-44de-9736-acc3669c7a6a

Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d69c030-d557-4d35-b5dc-99ee973f10eb

Unit42 OceanLotus 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1543.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75a7d2f6-fa2c-499c-8e4f-f8d1d2735173

TrendMicro MacOS April 2018 · sentinelone apt32 macOS backdoor 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79127e56-edbc-422b-9c32-72ce55f5ec04

ESET OceanLotus macOS April 2019

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1560.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bb51178-fa35-4441-99f3-f01fb305b03b

TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e6bbb1a-95c6-4f51-9aff-6b424c731cfc

Unit42 OceanLotus 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cabdb159-174a-4fbd-b026-1d67f8f59dcf

Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfae5caf-6084-4082-a2a4-8728ea424807

Unit42 OceanLotus 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6e81473-84f4-40f0-b7a1-122599f801e6

Unit42 OceanLotus 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1553.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e735944e-9387-4cfb-bf2c-0a1c27d93bce

Trend Micro MacOS Backdoor November 2020 · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee73acc3-a506-41a2-b7b9-e5aa9b68342b

TrendMicro MacOS April 2018

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f376ba97-3fe5-4c51-aa2c-0c1e35fcfcda

Trend Micro MacOS Backdoor November 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.