OAK — OnChain Attack Knowledge

Software · OAK-S19 · malware

OAK-S19 — KandyKorn

Type
malware
Aliases
KANDYKORN (Elastic Security Labs original naming, November 2023, retained as the canonical industry label); SUGARLOADER (Elastic naming for the early-stage component within the same intrusion chain that loads the KandyKorn Mach-O backdoor); HLOADER (Elastic naming for the LaunchAgent-persistence helper observed in the same chain — sometimes catalogued separately, sometimes folded into the KandyKorn family entry depending on vendor); naming-overlap caveat: KandyKorn is operationally tracked by Mandiant within the broader UNC4736 / AppleJeus / Citrine Sleet umbrella and by Microsoft within the Citrine Sleet weather-name lineage, so the same observed activity may be reported as "KandyKorn detected" or as "Citrine Sleet macOS staging" depending on the reporting vendor.
Active
yes (Elastic's original 2023 reporting characterised the family as actively-evolving; subsequent industry coverage through 2024–2025 places it within the continuing macOS DPRK lineage).
First observed
2023-11 (Elastic Security Labs, "KANDYKORN: Inside the Stash," November 1, 2023 — the canonical first-public-documentation date; underlying campaign activity tracked by Elastic from earlier in 2023).
Used by Groups
OAK-G01 (Lazarus / TraderTraitor cluster — Elastic's reporting attributes the campaign to DPRK-nexus activity within the cluster Mandiant tracks as UNC4736 and Microsoft tracks as Citrine Sleet, both of which are subsumed under the OAK-G01 Lazarus / TraderTraitor cluster naming for OAK purposes).
Host platforms
macOS (Intel and Apple Silicon — Elastic's original reporting documented Mach-O builds for both architectures within the same campaign infrastructure, consistent with the broader DPRK macOS lineage's shift to universal-binary distribution from 2022 onward).
Observed Techniques
OAK-T11.001 (third-party signing/custody-vendor compromise — KandyKorn was delivered as the initial-access payload onto engineering-staff workstations at crypto firms, where downstream lateral movement reached signing infrastructure), OAK-T11.002 (wallet-software distribution compromise — the lure pattern impersonated cross-platform arbitrage trading bots distributed to the engineering-staff target community). Pre-incident social-engineering vectors (Discord direct-message recruiter / counterparty pretext delivery) sit outside OAK v0.1 on-chain Tactic scope but are the defining entry surface.

Description

KandyKorn is a macOS-targeting multi-stage backdoor family attributed to the OAK-G01 Lazarus / TraderTraitor cluster, first publicly documented by Elastic Security Labs in November 2023 in the report "KANDYKORN: Inside the Stash." The family is operationally distinctive within the DPRK macOS lineage for its Discord-server engineering-community delivery channel — Elastic's reporting documents that operators targeted engineers at crypto firms via direct-message outreach inside Discord servers used by the cross-platform arbitrage-bot developer community, pretexting as fellow developers and delivering Python-language "arbitrage bot" payloads as the initial-stage lure.

Infection vector is multi-stage: the Discord-delivered Python loader (the SUGARLOADER stage in Elastic's naming) executes a chain that downloads, decrypts, and loads the final-stage Mach-O backdoor (the KandyKorn stage proper) into memory. Persistence is established via a LaunchAgent helper (the HLOADER stage in Elastic's naming) that masquerades as a legitimate Discord helper process and re-launches the backdoor across reboots. Post-compromise behavior is hands-on-keyboard capable: KandyKorn provides file enumeration, file exfiltration, command execution, process listing, and additional-payload-loading capability sufficient for operator-driven reconnaissance and lateral movement within the victim's engineering environment. C2 communication uses a custom RC4-encrypted protocol over TCP to operator-controlled infrastructure, with the encryption key and protocol obfuscation rotated per-campaign.

The operational role of KandyKorn in the DPRK financial-funding chain is initial access into the crypto-firm engineering perimeter, with the same downstream-extraction outcomes as the broader OAK-G01 toolset: once the backdoor establishes persistence on an engineer's workstation, operators move laterally toward signing-infrastructure, wallet-software-build environments, and cold-wallet-adjacent systems, ultimately enabling the canonical OAK-G01 supply-chain-compromise extraction pattern. The Discord-channel delivery distinguishes KandyKorn methodologically from the LinkedIn-recruiter-channel delivery characteristic of the broader TraderTraitor lineage; from a defender perspective the appropriate model is channel-rotation across a stable lure-and-payload pattern — the lure pretext (cross-platform arbitrage bot, free trading tool, coding test) and payload chain (Python loader → Mach-O backdoor → persistence helper) are stable across delivery channels.

Observed examples

  • Elastic Security Labs initial campaign cohort (2023). Elastic's November 2023 report ([elastickandykorn2023]) documented the original observed-in-the-wild KandyKorn campaign against Discord-channel-engaged engineering-staff targets at multiple crypto firms; the per-firm naming was withheld in the public reporting for victim-protection reasons but the campaign cohort is the canonical evidence base for the family. Confirmed-grade vendor attribution to DPRK-nexus activity.
  • Citrine Sleet / UNC4736 lineage continuity (2024–2025). Microsoft Threat Intelligence ([microsoftcitrineradiant2024]) and Mandiant ([mandiantradiant2024]) tracking through 2024 places KandyKorn-family staging within the broader macOS DPRK lineage active through the Radiant Capital (October 2024) and surrounding incident wave; per-incident family-naming for KandyKorn-specific staging is not always made explicit in public reporting but the lineage's continuity is documented across multi-vendor reporting.
  • Cross-correlation with the OAK-G01 incident series. The 2024–2025 OAK-G01 incident wave (DMM Bitcoin May 2024, WazirX July 2024, Radiant Capital October 2024, Bybit February 2025) consistently shows macOS-side initial-access tooling consistent with the AppleJeus / KandyKorn / RustBucket / SwiftLoader lineage; per-incident KandyKorn-specific staging was named in the Radiant Capital case context (under the INLETDRIFT naming used in the post-mortem, with naming overlap to the KandyKorn lineage flagged by some industry analysts). Inferred-strong attribution at the lineage level.

Detection / attribution signals

Defenders should treat KandyKorn detection as a chain-pattern problem because the family's distinctive signature is the multi-stage-loader chain rather than any single artifact:

  • Lure-channel telemetry — anomalous Discord direct-message recruiter / fellow-developer outreach to engineering staff with subsequent Python-payload delivery; Discord-server administration teams at crypto-engineering communities should treat unsolicited cross-platform-arbitrage-bot DMs as high-prior phishing surface. This is the highest-yield top-of-funnel signal for the KandyKorn-specific delivery channel.
  • Python-loader process-tree fingerprints — python3 processes invoked under user-context with command-line arguments referencing arbitrage-bot scripts, network connections to non-developer-tool-typical hosts, and subsequent spawning of additional Python child processes that perform decryption and in-memory Mach-O loading; the chain's Python-as-loader shape is itself a fingerprint distinguishing KandyKorn from single-stage commodity macOS malware.
  • LaunchAgent persistence fingerprints — ~/Library/LaunchAgents/ plist entries with labels masquerading as legitimate Discord, Slack, or developer-tool helper processes; the HLOADER stage's persistence mechanism is the same surface that the broader DPRK macOS lineage uses, so detection content authored for the lineage covers KandyKorn as a special case.
  • Mach-O backdoor process-tree fingerprints — non-Apple-developer-team-ID-signed (or ad-hoc-signed) Mach-O binaries running under user context with TCP outbound connections to non-CDN, non-cloud-provider hosts on non-standard ports; the RC4-encrypted protocol-obfuscation shape is documented in Elastic's reporting and should be consumed via vendor-published Yara rules rather than transcribed here.
  • C2-protocol fingerprints — TCP outbound traffic with high-entropy payload bodies that lack TLS handshake structure; the RC4-encrypted custom-protocol shape is distinct from HTTPS-tunneled C2 used by some other DPRK families and is itself a behavioral signal.
  • Behavioral signatures from CTI vendors — Elastic Security Labs (foundational KandyKorn / SUGARLOADER / HLOADER detections via the Elastic Security platform), SentinelOne (KandyKorn-family detections in the Singularity platform), Jamf Threat Labs (macOS-specific lineage-level detections covering KandyKorn alongside RustBucket / Hidden Risk), Microsoft (Citrine Sleet rules in Defender for Endpoint that cover KandyKorn-lineage staging).
  • Cross-correlation with on-chain G01 cluster watchlists — a workstation compromise consistent with KandyKorn at a crypto-firm whose downstream signing path reaches into custody / cold-wallet / multisig infrastructure raises the prior on a subsequent OAK-T11.001 / T11.002 extraction event.

Note: omit specific file hashes from this entry; consume current IOCs from Elastic's published indicator-of-compromise list in the original report and from live CTI-vendor feeds.

Citations

  • [elastickandykorn2023] — Elastic Security Labs, "KANDYKORN: Inside the Stash," November 1, 2023. Primary first-public-documentation reference for the family; canonical industry anchor for behavioral signatures, the multi-stage loader chain (SUGARLOADER → KandyKorn → HLOADER), and DPRK-nexus attribution at vendor confirmed-grade.
  • [mandiantradiant2024] — Mandiant attribution of the September / October 2024 Radiant Capital compromise to UNC4736 / AppleJeus / Citrine Sleet; lineage-continuity reference covering the 2024 macOS DPRK toolset.
  • [microsoftcitrineradiant2024] — Microsoft Threat Intelligence Citrine Sleet reporting through 2024; cross-vendor lineage-continuity reference.
  • [chainalysis2024dprk] — DPRK-attributed cryptocurrency-theft scale; the aggregate volume that the macOS-lineage initial-access activity (KandyKorn / RustBucket / SwiftLoader) feeds into.
  • [cisaaa22108a] — CISA / FBI / Treasury TraderTraitor advisory; cluster-level confirmed-grade anchor for the OAK-G01 attribution that KandyKorn sits within.

Discussion

On lineage and ecosystem position. KandyKorn sits within the post-AppleJeus DPRK macOS lineage alongside RustBucket (OAK-S20), SwiftLoader (OAK-S21), and ObjCShellz (OAK-S22). The lineage progression — AppleJeus (Objective-C, 2018) → TraderTraitor (cross-platform Electron, 2022) → KandyKorn (Python loader + Mach-O, 2023) → RustBucket (Rust, 2023) → SwiftLoader / ObjCShellz successors (2023–2024) — represents continuing operator iteration on implementation language and loader-chain shape while preserving the lure-and-payload tradecraft. KandyKorn's distinctive contribution to the lineage is the Discord-channel delivery and the Python-loader-into-Mach-O chain; both are operationally specific to this family entry and should be tracked separately by defender content authors even where the broader Citrine Sleet / UNC4736 umbrella is the cluster-level frame.

On attribution caveats. Cluster-level attribution to OAK-G01 (Lazarus / TraderTraitor / UNC4736 / Citrine Sleet) is confirmed via Elastic's vendor reporting corroborated by Mandiant and Microsoft. Per-incident attribution that a specific compromise used KandyKorn as the entry-vector payload is inferred-strong in most public cases — Elastic's original report named the activity but withheld per-victim naming, and subsequent industry coverage tends to attribute at the lineage level rather than at the family level. Defenders should treat KandyKorn as a near-default expectation among DPRK-attributed Discord-channel-delivered macOS payloads against engineering-staff targets at crypto firms.

On the G01 vs G08 cluster question. Elastic's original reporting positions KandyKorn within the broader DPRK-against-crypto-industry intrusion set without sub-cluster-naming between Lazarus / TraderTraitor (OAK-G01) and BlueNoroff (OAK-G08); subsequent Mandiant tracking under UNC4736 / AppleJeus / Citrine Sleet places it on the OAK-G01 side of that distinction. The OAK assignment of KandyKorn to OAK-G01 (rather than OAK-G08) follows Mandiant's lineage placement; defenders should note that the G01 / G08 distinction within the DPRK financial-cyber bureaucracy is itself an industry-tracking convention rather than a confirmed organisational separation, and that toolset overlap between the two clusters is documented (see SwiftLoader, OAK-S21, which is observed across both).

On naming-overlap with INLETDRIFT. The Radiant Capital post-mortem ([radiantpostmortem2024]) names the macOS backdoor used in that incident as INLETDRIFT; some industry analysts have flagged behavioral overlap between INLETDRIFT and the KandyKorn lineage. Whether INLETDRIFT is a renamed KandyKorn variant, a sibling family within the same lineage, or a distinct family is not definitively resolved in public reporting as of OAK v0.1 cutoff; defenders consuming detection content should track both labels and watch for vendor-side reconciliation.

Techniques observed (2)

Used by