Mach-O in Three Dimensions

This talk from Jamf's macOS threat labs presents a research project that places a large collection of macOS malware samples into a three-dimensional space. Each sample is converted into a vector built from its static features or its assembly code, so binaries that are similar end up plotted close together. The team built a custom browser viewer on a 3D JavaScript library and calls it Titan.

The demonstration walks through clusters of samples and what an analyst can read from them, including family labels, vendor consensus, YARA coverage, architecture and signing team. Several use cases stand out. An outlier inside an Atomic Stealer cluster exposed a YARA rule that missed related samples, and a group of generic detections turned out to likely be the same family. Encoded variants still landed beside their families, and a filter showed Intel builds far outnumbering ARM ones. The speaker noted that the dataset is somewhat dated.

The final case study looked at BeaverTail, which earlier public reporting linked to the Lazarus Group. Nearby in the space sat a known Lazarus backdoor, and a binary diff of the two showed similar functions with extra logic added. The speaker framed the output as leads for manual analysis rather than automated attribution, and closed with an update on an upcoming self-published book.