{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "AMOS stealer exfiltrates high-value assets including AWS credentials, cryptocurrency wallets, and browser-stored passwords. Detecting the network exfiltration sequence is a critical final opportunity to limit the impact of an intrusion." }, "name": "AMOS Stealer C2 and Exfiltration Patterns", "type": "investigation", "labels": [ "hunt", "attack.t1071.001", "attack.t1041", "attack.t1090.003" ], "series": { "slug": "atomic-macos-amos-stealer-activity", "index": 2, "title": "Atomic macOS (AMOS) Stealer Activity", "total": 2 }, "related": [ { "hunt": "amos-stealer-persistence-and-collection", "reason": "This hunt focuses on network behavior; local file persistence and collection artifacts belong to a separate investigation surface.", "relation": "out-of-scope-alternative" }, { "hunt": "amos-stealer-macos-phased", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple detection rule targeting the listed IPs will fail within days. This hunt uses a behavioral pivot by searching for the specific sequence of exfiltration stages in HTTP requests and stack-counting those patterns to identify rare, malicious traffic across the fleet.", "coverage": [ { "stage": "c2-exfiltration-over-http", "steps": [ "c2-ip-connections", "http-stage-patterns", "dns-malicious-lookups" ], "status": "covered" }, { "stage": "initial-access-copy-paste-terminal", "reason": "Covered by the initial access hunt in this series.", "status": "out_of_scope" }, { "stage": "persistence-via-hidden-application-support", "reason": "Covered by the persistence hunt in this series.", "status": "out_of_scope" }, { "stage": "script-execution-and-payload-retrieval", "reason": "Belongs to another part of the 'Atomic macOS (AMOS) Stealer Activity' series.", "status": "out_of_scope" }, { "stage": "credential-and-wallet-collection", "reason": "Belongs to another part of the 'Atomic macOS (AMOS) Stealer Activity' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Deceptive Terminal Command Execution", "slug": "initial-access-copy-paste-terminal", "tactic": "initial-access", "techniques": [ "T1204.001", "T1059.004" ], "observables": [ "getmacouscloud.com", "curl -s hxxps://ferncore13.com/curl/...", "zsh -c \"$(curl ...)\"" ] }, { "name": "Scripted Payload Retrieval", "slug": "script-execution-and-payload-retrieval", "tactic": "execution", "techniques": [ "T1105", "T1059.004" ], "observables": [ "ferncore13.com", "grove-89.com", "/tmp/helper", "71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c", "7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a" ] }, { "name": "Hidden Application Support Persistence", "slug": "persistence-via-hidden-application-support", "tactic": "persistence", "techniques": [ "T1543.001", "T1564.001" ], "observables": [ "/tmp/starter", "~/Library/Application Support/.com.apple.accountsd/", "~/Library/Application Support/.com.apple.metadata.mds/", ".service", ".mdworker", "AccountsHelper", "mdworker_shared" ] }, { "name": "Credential and Wallet Harvesting", "slug": "credential-and-wallet-collection", "tactic": "collection", "techniques": [ "T1555", "T1115", "T1560.001" ], "observables": [ "/tmp/out.zip", "zsh_history", "deskwallets/Binance/", "FileGrabber/aws/", "FileGrabber/docker/", "Telegram Data/" ] }, { "name": "Command and Control Exfiltration", "slug": "c2-exfiltration-over-http", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1041" ], "observables": [ "161.35.146.120", "188.166.78.138", "stage=boot", "stage=credentials", "stage=wallets", "stage=browsers" ] } ], "summary": "Atomic macOS (AMOS) stealer infects users via deceptive toolkit setup pages that trick them into running Zsh scripts in Terminal. The malware establishes persistence through hidden directories and scripts in Application Support, harvests credentials and cryptocurrency wallets, and exfiltrates the staged data to C2 servers over HTTP." }, "severity": "high", "rationale": "Focus the search on macOS endpoints. While the C2 IPs are specific to early August 2026, the HTTP POST stage parameters are a durable indicator of the malware's exfiltration logic.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary exfiltrates keychain, browser, and wallet data from macOS hosts by sending a sequence of HTTP POST requests containing specific stage parameters to malicious infrastructure.", "parameters": { "c2_ips": { "from": { "ref": "unit42-amos-2026", "kind": "article", "observed": "2026-08-05" }, "type": "list[ip]", "default": [ "161.35.146.120", "188.166.78.138" ], "description": "Known AMOS command and control IP addresses." }, "c2_domains": { "from": { "ref": "unit42-amos-2026", "kind": "article", "observed": "2026-08-05" }, "type": "list[domain]", "default": [ "getmacouscloud.com", "ferncore13.com", "grove-89.com" ], "description": "Domains used by AMOS for delivery and C2." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-09-16" }, "type": "list[host]", "default": [], "description": "Optional list of hosts to narrow the behavioral search." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-09-16" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "name": "Unit 42 \u2014 Atomic macOS (AMOS) Stealer Activity" } ], "blind_spots": [ { "id": "limited-http-visibility", "risk": "Malware using HTTPS may hide the stage query parameters from network-level sensors, leaving only IP/DNS metadata for analysis.", "stage": "c2-exfiltration-over-http", "question": "whether exfiltration is occurring over encrypted channels that hide URL parameters", "requires": "TLS inspection or endpoint-based HTTP logging" }, { "id": "ephemeral-infrastructure", "risk": "AMOS infrastructure rotates daily; a negative result on specific IPs does not guarantee a host is clean if the behavioral exfiltration pattern is also missed.", "stage": "c2-exfiltration-over-http", "question": "whether the infection is communicating with new, undocumented C2 IPs", "requires": "frequent indicator updates" } ] }, "name": "AMOS Stealer C2 and Exfiltration Patterns", "description": "The adversary transmits stolen browser data, credentials, and cryptocurrency wallets via HTTP POST requests after collecting them on the host. These requests include a stage parameter identifying the type of data being sent, such as boot, credentials, or wallets. This hunt identifies behavioral network patterns by searching for these parameters and correlating them with known malicious infrastructure. An agent weighs the network evidence to confirm an active AMOS infection and routes the host for isolation if exfiltration is detected." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "atomic-macos-amos-stealer-activity", "index": 2, "title": "Atomic macOS (AMOS) Stealer Activity", "total": 2 }, "coverage": [ { "stage": "c2-exfiltration-over-http", "steps": [ "c2-ip-connections", "http-stage-patterns", "dns-malicious-lookups" ], "status": "covered" }, { "stage": "initial-access-copy-paste-terminal", "reason": "Covered by the initial access hunt in this series.", "status": "out_of_scope" }, { "stage": "persistence-via-hidden-application-support", "reason": "Covered by the persistence hunt in this series.", "status": "out_of_scope" }, { "stage": "script-execution-and-payload-retrieval", "reason": "Belongs to another part of the 'Atomic macOS (AMOS) Stealer Activity' series.", "status": "out_of_scope" }, { "stage": "credential-and-wallet-collection", "reason": "Belongs to another part of the 'Atomic macOS (AMOS) Stealer Activity' series.", "status": "out_of_scope" } ], "rationale": "An adversary exfiltrates keychain, browser, and wallet data from macOS hosts by sending a sequence of HTTP POST requests containing specific stage parameters to malicious infrastructure.", "blind_spots": [ { "id": "limited-http-visibility", "risk": "Malware using HTTPS may hide the stage query parameters from network-level sensors, leaving only IP/DNS metadata for analysis.", "stage": "c2-exfiltration-over-http", "question": "whether exfiltration is occurring over encrypted channels that hide URL parameters", "requires": "TLS inspection or endpoint-based HTTP logging" }, { "id": "ephemeral-infrastructure", "risk": "AMOS infrastructure rotates daily; a negative result on specific IPs does not guarantee a host is clean if the behavioral exfiltration pattern is also missed.", "stage": "c2-exfiltration-over-http", "question": "whether the infection is communicating with new, undocumented C2 IPs", "requires": "frequent indicator updates" } ], "scoping_notes": "Focus the search on macOS endpoints. While the C2 IPs are specific to early August 2026, the HTTP POST stage parameters are a durable indicator of the malware's exfiltration logic.", "beyond_detection": "A simple detection rule targeting the listed IPs will fail within days. This hunt uses a behavioral pivot by searching for the specific sequence of exfiltration stages in HTTP requests and stack-counting those patterns to identify rare, malicious traffic across the fleet." } }, { "id": "c2-ip-connections", "type": "query", "label": "Direct connections to known C2 infrastructure", "config": { "dsl": "sqlite", "role": "scoping", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Identify hosts establishing direct network connections to the IP addresses reported in AMOS campaigns.", "expected_signal": "A hit shows a host communicating with a known malicious IP. Silence suggests no direct connection occurred to these specific nodes within the window." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Direct connections to known C2 infrastructure", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A hit shows a host communicating with a known malicious IP. Silence suggests no direct connection occurred to these specific nodes within the window.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "http-stage-patterns", "type": "query", "label": "Exfiltration stage patterns in HTTP POST requests", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, url_hostname, url_query, http_method, user_agent, COUNT(*) as req_count, MIN(time) as first_seen FROM hb_http_activity WHERE http_method = 'POST' AND (LOWER(url_query) LIKE '%stage=boot%' OR LOWER(url_query) LIKE '%stage=init_session%' OR LOWER(url_query) LIKE '%stage=credentials%' OR LOWER(url_query) LIKE '%stage=wallets%' OR LOWER(url_query) LIKE '%stage=browsers%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_query, http_method, user_agent", "surface": "hb_http_activity", "description": "Detect the characteristic stage parameters used by AMOS during exfiltration across the fleet or scoped hosts.", "expected_signal": "Multiple POST requests with different stage values from a single host indicate active data exfiltration. Silence provides evidence of absence if proxy or endpoint coverage is complete." }, "parents": [ { "id": "c2-ip-connections" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Exfiltration stage patterns in HTTP POST requests", "reads": [ "device_hostname", "url_hostname", "url_query", "http_method", "user_agent", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, url_query, http_method, user_agent, COUNT(*) as req_count, MIN(time) as first_seen FROM hb_http_activity WHERE http_method = 'POST' AND (LOWER(url_query) LIKE '%stage=boot%' OR LOWER(url_query) LIKE '%stage=init_session%' OR LOWER(url_query) LIKE '%stage=credentials%' OR LOWER(url_query) LIKE '%stage=wallets%' OR LOWER(url_query) LIKE '%stage=browsers%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, url_query, http_method, user_agent", "silence": "evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Multiple POST requests with different stage values from a single host indicate active data exfiltration. Silence provides evidence of absence if proxy or endpoint coverage is complete.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "url_hostname", "url_query" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "dns-malicious-lookups", "type": "query", "label": "DNS lookups for delivery and C2 domains", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) as lookup_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name", "surface": "hb_dns_activity", "description": "Identify hosts attempting to resolve domains associated with the AMOS infection chain.", "expected_signal": "Lookups to ferncore13.com or getmacouscloud.com from user processes confirm the host interacted with malicious infrastructure." }, "parents": [ { "id": "c2-ip-connections" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS lookups for delivery and C2 domains", "reads": [ "device_hostname", "query_hostname", "process_name", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) as lookup_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name", "silence": "not_evidence_of_absence", "expected": "Lookups to ferncore13.com or getmacouscloud.com from user processes confirm the host interacted with malicious infrastructure.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-amos-activity", "type": "analytic", "label": "Triage exfiltration evidence", "config": { "cite": "required", "tools": [ "endpoint", "network", "web" ], "context": [ "c2-ip-connections", "http-stage-patterns", "dns-malicious-lookups" ], "objective": "Determine if any macOS hosts are infected with AMOS stealer by weighing direct C2 connections, exfiltration stage patterns, and malicious DNS lookups.", "description": "Correlate the connection, HTTP, and DNS evidence to settle a verdict for each affected host.", "max_iterations": 6, "expected_signal": "A summarized verdict citing the specific HTTP stages and matching infrastructure.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign with cited rows for the exfiltration stages." }, "parents": [ { "id": "http-stage-patterns", "kind": "merge" }, { "id": "dns-malicious-lookups", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on triage results", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host", "condition": "the triage verdict is malicious for at least one host", "blind_spot": "limited-http-visibility", "confidence": "high", "description": "Route the hunt based on whether active AMOS exfiltration was confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-amos-activity" } ] }, { "id": "isolate-infected-host", "type": "action", "label": "Isolate infected host", "config": { "target": "endpoint", "description": "Immediately sever the C2 connection to prevent further data loss.", "instructions": "Isolate the host and initiate credential revocation for all users associated with the device.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-manual-review", "type": "task", "label": "Manual forensic review", "config": { "assignee": "analyst", "description": "Verify the agent findings and search for on-disk persistence artifacts.", "instructions": "Review the triage evidence and check for the presence of hidden directories in Application Support such as .com.apple.accountsd or .com.apple.metadata.mds." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-infected-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document the negative result and any telemetry gaps.", "instructions": "Record the hunt results and note if any hosts in scope lacked endpoint telemetry." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" } ] } ] }