XCSSET

ATP Sandbox Adv. HeuristicsAV

Stats

First seen: February 2022
Last seen: September 2026

Also known as

Xcsset

MITRE ATT&CK techniques

33 techniques across 12 tactics.

TA0001 Initial Access

T1195Supply Chain Compromise
- T1195.001Compromise Software Dependencies and Development Tools

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.004Unix Shell
T1569System Services
- T1569.001Launchctl

TA0003 Persistence

T1098Account Manipulation
- T1098.004SSH Authorized Keys
T1543Create or Modify System Process
- T1543.004Launch Daemon
T1554Compromise Host Software Binary

TA0004 Privilege Escalation

T1068Exploitation for Privilege Escalation
T1546Event Triggered Execution
- T1546.004Unix Shell Configuration Modification
T1546Event Triggered Execution
- T1546.004Unix Shell Configuration Modification
T1548Abuse Elevation Control Mechanism
- T1548.006TCC Manipulation

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks
T1564Hide Artifacts
- T1564.001Hidden Files and Directories
T1574Hijack Execution Flow
- T1574.006Dynamic Linker Hijacking

TA0006 Credential Access

T1539Steal Web Session Cookie

TA0007 Discovery

T1082System Information Discovery
T1083File and Directory Discovery
T1087Account Discovery
T1518Software Discovery
- T1518.001Security Software Discovery
T1614System Location Discovery
- T1614.001System Language Discovery

TA0009 Collection

T1005Data from Local System
T1056Input Capture
- T1056.002GUI Input Capture
T1113Screen Capture
T1560Archive Collected Data

TA0011 Command and Control

T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0040 Impact

T1486Data Encrypted for Impact

TA0112 Defense Impairment

T1222File and Directory Permissions Modification
- T1222.002Linux and Mac Permissions
T1553Subvert Trust Controls
- T1553.001Gatekeeper Bypass
T1647Plist File Modification

Alert name variants

Alert Name	Engine
Gen:Variant.MAC.XCSSET.1	AV
Gen:Variant.Trojan.MAC.XCSSET.1	AV
MacOS.Trojan.Xcsset	ATP Sandbox Adv. Heuristics
Trojan.MAC.XCSSET.A	AV
Trojan.MAC.XCSSET.B	AV
Trojan.MAC.XCSSET.C	AV

Related families

DarkGate LODEINFO QakBot RedLine Stealer Woody RAT