Made In America: Analyzing US Spy Agencies macOS Implants

Runa Sandvik and Patrick Wardle examine two macOS implants leaked between 2015 and 2017: Green Lambert, linked to the CIA's Lamberts family, and Double Fantasy, linked to the NSA. They present the samples as old artifacts whose study shows how sophisticated operators build and engineer their tools.

Sandvik starts with Green Lambert. She ties its development documents to reporting from Symantec and Kaspersky, then does static triage, reviews the symbols to work out which OS release it needs, and runs it on an old Lion system. She covers persistence through a launch agent, how its behaviour changes when offline, and how she recovered command-line arguments and encrypted strings using Hopper and LLDB. A certificate history for its command domain helps place activity around 2007 to 2013.

Wardle then covers Double Fantasy, a first-stage implant. He writes a Hopper script to find and decrypt its embedded strings, which reveals command-line flags, a configuration format and a survey routine that he runs in a debugger. He also maps a jump table of remote commands, including a download-and-execute command that clears DYLD variables first. The practical takeaway is that the same workflow applies to any macOS malware, and that the samples show careful engineering such as proper daemonization and support for authenticating proxies.