Komplex

ATP Sandbox Adv. HeuristicsAV

Description

Komplex is a backdoor that APT28 has used on OS X, developed in a similar manner to the XAgentOSX backdoor for that platform.

Stats

First seen: February 2022
Last seen: October 2026

MITRE ATT&CK techniques

7 techniques across 4 tactics.

TA0003 Persistence

T1543Create or Modify System Process
- T1543.001Launch Agent

TA0005 Stealth

T1070Indicator Removal
- T1070.004File Deletion
T1564Hide Artifacts
- T1564.001Hidden Files and Directories

TA0007 Discovery

T1033System Owner/User Discovery
T1057Process Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Associated groups

G0007APT28

Alert name variants

Alert Name	Engine
MacOS.Trojan.Komplex	ATP Sandbox Adv. Heuristics
Trojan.MAC.Komplex.A	AV
Trojan.MAC.Komplex.D	AV

Related families

InvisiMole PlugX QakBot Bazar KONNI

References