Threat Summary Recent OTX pulses indicate a surge in sophisticated evasion techniques across both macOS and Windows platforms. The re-emergence of XCSSET v40 marks a significant evolution in macOS malware, specifically targeting developers through supply chain compromises of legitimate Xcode projects. Simultaneously, the SakDriver kernel rootkit represents a high-level threat to Windows environments, employing Ring 0 privileges to disable security logging via ETW patching and hide processes using DKOM. Both campaigns share a common objective: deep, stealthy persistence that circumvents standard endpoint detection and response (EDR) controls.
Threat Actor / Malware Profile
1. XCSSET v40 (macOS)
- Malware Families: XCSSET (S0658), OSX.DubRobber, NETWIRE (S0198), FruitFly (S0277).
- Distribution: Supply chain attack via compromised Xcode projects hosted on GitHub. Developers inadvertently build malware into their applications.
- Payload Behavior: The malware performs polymorphic payload generation and in-memory execution to avoid disk-based scanning. It also installs secondary payloads like NETWIRE and FruitFly for remote access.
- C2 Communication: Utilizes domains such as
bulksec.ru,figmacat.ru, andwindsecure.ru. - Persistence: Fileless persistence mechanisms, likely leveraging launch agents or injected scripts within the Xcode build process.
- Anti-Analysis: Advanced polymorphism changes the payload structure on every infection to evade signature-based detection.
2. SakDriver / CrackerDrv (Windows)
- Malware Families: SakDriver, CrackerDrv.
- Distribution: Likely delivered via exploit loaders or phishing; associated with CVE-2026-6307.
- Payload Behavior: Operates at Ring 0 (Kernel Mode). Patches Event Tracing for Windows (ETW) to blind security tools. Uses Direct Kernel Object Manipulation (DKOM) to hide processes and registry keys. Manipulates Windows Filtering Platform (WFP) to block traffic to security vendor IPs.
- C2 Communication: Uses NSI driver hooking to conceal C2 ports and network connections.
- Persistence: Installed as a kernel driver service.
- Anti-Analysis: Disables system logging (ETW) and actively blocks security software processes via WFP manipulation.
IOC Analysis The provided IOCs span infrastructure, file artifacts, and vulnerabilities.
- Network Indicators: 6 IP addresses and 5 domains associated with XCSSET C2. SOC teams should immediately block these at the perimeter and firewalls.
- File Indicators: Multiple hashes (MD5, SHA1, SHA256) for the SakDriver rootkit and XCSSET samples. These should be loaded into EDR blacklist databases.
- CVE: CVE-2026-6307 is linked to the rootkit, suggesting a potential exploitation vector requiring urgent patching.
Detection Engineering
YAML
---
title: Potential XCSSET v40 Infection via Xcode Build
id: 4a2c9f1e-8b3d-4c5f-9a10-1b2c3d4e5f6a
description: Detects suspicious child processes spawned by Xcode or execution of scripts within Xcode project directories, characteristic of XCSSET supply chain attacks.
status: experimental
author: Security Arsenal Research
date: 2026/08/03
references:
- https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/
tags:
- attack.supply_chain
- attack.execution
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|endswith: '/Xcode'
Image|endswith:
- '/osascript'
- '/bash'
- '/python'
- '/sh'
condition: selection
falsepositives:
- Legitimate build scripts
level: high
---
title: SakDriver Kernel Rootkit Installation
id: 5b3d0a2f-9c4e-5d6g-0b21-2c3d4e5f6a7b
description: Detects the loading of the SakDriver kernel rootkit by specific file hashes or suspicious driver load events.
status: experimental
author: Security Arsenal Research
date: 2026/08/03
references:
- https://core-jmp.org/2026/07/sakdriver-reversing-kernel-driver-rootkit/
tags:
- attack.privilege_escalation
- attack.defense_evasion
logsource:
category: driver_load
product: windows
detection:
selection_hash:
Hashes|contains:
- '4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d'
- 'b5f122f3f07f618c0a7678fa40801faa'
selection_suspicious:
Signed: 'false'
ImageLoaded|endswith: '.sys'
condition: 1 of selection*
falsepositives:
- Unsigned legitimate drivers (rare in enterprise)
level: critical
---
title: XCSSET C2 Network Traffic
id: 6c4e1b3g-0d5f-6e7h-1c32-3d4e5f6a7b8c
description: Detects network connections to known XCSSET v40 C2 domains.
status: experimental
author: Security Arsenal Research
date: 2026/08/03
references:
- https://otx.alienvault.com/pulse/
tags:
- attack.c2
- attack.command_and_control
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationHostname|contains:
- 'bulksec.ru'
- 'figmacat.ru'
- 'windsecure.ru'
- 'applecdn.ru'
- 'cdnroute.ru'
- 'checkcdn.ru'
condition: selection
falsepositives:
- None
level: critical
kql
// Hunt for XCSSET Network Connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("bulksec.ru", "figmacat.ru", "windsecure.ru", "applecdn.ru", "cdnroute.ru", "checkcdn.ru")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
// Hunt for SakDriver Kernel Driver Loads
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in ("fltmc.exe", "sc.exe", "pnputil.exe")
| where ProcessCommandLine contains "4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d" or ProcessCommandLine contains ".sys"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
// Hunt for ETW Manipulation (Potential SakDriver Indicators)
SecurityEvent
| where Timestamp > ago(7d)
| where EventID == 4103 or EventID == 4104 // Powershell Script Block / Module Logging - looking for tampering attempts
| where Message contains "ETW" or Message contains "EventTracing"
| project Timestamp, Computer, Account, Message
powershell
# IOC Hunt Script for XCSSET and SakDriver
# Requires Admin Privileges
Write-Host "[*] Starting IOC Hunt..." -ForegroundColor Cyan
# 1. Check for XCSSET Domains in DNS Cache
Write-Host "[+] Checking DNS Cache for XCSSET domains..." -ForegroundColor Yellow
$domains = @("bulksec.ru", "figmacat.ru", "windsecure.ru", "applecdn.ru", "cdnroute.ru", "checkcdn.ru")
$dnsCache = Get-DnsClientCache
foreach ($d in $domains) {
if ($dnsCache | Where-Object { $_.Entry -like "*$d*" }) {
Write-Host "[!] ALERT: Found DNS entry for $d" -ForegroundColor Red
}
}
# 2. Check for SakDriver File Hash
Write-Host "[+] Scanning system32/drivers for SakDriver hash..." -ForegroundColor Yellow
$targetHash = "4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d"
$driverPath = "C:\Windows\System32\drivers\"
if (Test-Path $driverPath) {
Get-ChildItem -Path $driverPath -Filter *.sys | ForEach-Object {
$hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
if ($hash -eq $targetHash) {
Write-Host "[!] CRITICAL: SakDriver found at $($_.FullName)" -ForegroundColor Red
}
}
}
# 3. Check for Suspicious Network Connections (SakDriver C2 IPs)
Write-Host "[+] Checking active connections to SakDriver IPs..." -ForegroundColor Yellow
$ips = @("43.160.247.24", "91.99.165.207")
$connections = Get-NetTCPConnection -State Established
foreach ($ip in $ips) {
if ($connections | Where-Object { $_.RemoteAddress -eq $ip }) {
Write-Host "[!] ALERT: Active connection to C2 IP $ip" -ForegroundColor Red
}
}
Write-Host "[*] Hunt complete." -ForegroundColor Green
**Response Priorities**
* **Immediate:**
* Block all listed XCSSET domains (`*.ru`) and SakDriver IPs (`43.160.247.24`, `91.99.165.207`) on perimeter firewalls and proxies.
* Initiate a scan for the SHA256 hash `4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d` across all endpoints to locate SakDriver infections.
* Isolate any macOS devices used for development that show signs of unauthorized `osascript` or bash execution originating from Xcode.
* **24 Hours:**
* Investigate GitHub repositories currently in use by development teams to ensure Xcode project integrity (verify against clean backups).
* Review Windows Event Logs for Driver Load events (Event ID 6) matching the SakDriver indicators.
* Apply patches for CVE-2026-6307 if available and relevant to the environment.
* **1 Week:**
* Implement code-signing enforcement for all kernel drivers (Windows) and applications (macOS).
* Enforce strict "Allowlist" policies for software development tools and external library imports.
* Conduct a security review of developer workstations to ensure local admin privileges are minimized and EDR agents are functioning (checking for ETW blind spots).
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.