Full Report
A look inside the evolving landscape of macOS malware. Dive into the current state of macOS threats and learn from a glossary of essential macOS terms.
Analysis Summary
# Tool/Technique: macOS Background Task Management (BTM) & Persistence Evasion
## Overview
Background Task Management (BTM) is a security framework introduced by Apple in macOS Ventura to provide users and security software with visibility into applications that register to run in the background. While intended as a security feature, it serves as a central hub for malware analysts to identify persistence mechanisms used by threats like RustBucket and LockBit.
## Technical Details
- **Type:** Technique / Security Framework (Analysis focal point)
- **Platform:** macOS (Ventura and later)
- **Capabilities:** Tracking Launch Items, Login Items, and background processes; attribution of persistence to specific Developer Team IDs.
- **First Seen:** November 2022 (macOS Ventura release)
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1547 - Boot or Logon Autostart Execution]**
- **[T1547.015 - Apple Software Autostart Execution]**
- **[TA0005 - Defense Evasion]**
- **[T1553.006 - Code Signing]** (Used to bypass/validate items in BTM)
## Functionality
### Core Capabilities
- **Serialization of Persistence:** Maintains a binary plist record of all Launch Items and Login Items on the system.
- **Embedded Launch Items:** Allows Launch Items to be bundled directly within an application bundle (`.app`), rather than just traditional directories like `/Library/LaunchDaemons`.
- **Visibility Tools:** Enables administrators to dump the database using the `sfltool dumpbtm` command to view path URLs and Team Identifiers.
### Advanced Features
- **Endpoint Security (ES) API Integration:** Provides real-time notifications via `ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD` and `REMOVE`, allowing security tools to monitor for new persistence in real-time.
- **Attribution:** Maps background tasks to specific developer certificates and team IDs to identify unauthorized or "unsigned" persistence.
## Indicators of Compromise
- **File Names:**
- `/System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Support/BackgroundTaskManagementAgent.app/Contents/MacOS/BackgroundTaskManagementAgent` (BTM binary)
- **Behavioral Indicators:**
- Unexpected entries in `sfltool dumpbtm` output.
- Frequent unauthorized additions to BTM notifications via Endpoint Security.
- Cross-platform malware (Go-based) attempting to bypass Notarization/TCC.
## Associated Threat Actors
- **LockBit:** Identified targeting macOS with ransomware variants.
- **Lazarus Group (implied):** Linked to the **RustBucket** nation-state malware.
- **Adware Developers:** Specifically operators of **Pirrit** and **Adload** families.
## Detection Methods
- **Signature-based detection:** Monitoring for known malicious Team IDs in the BTM database.
- **Behavioral detection:** Monitoring for modifications to the BTM database or the execution of unsigned code via Endpoint Security events.
- **Command Line Analysis:** Regular auditing of the BTM state using `sfltool dumpbtm`.
## Mitigation Strategies
- **Gatekeeper and Notarization:** Ensure all deployed applications are notarized and signed by known developers.
- **TCC (Transparency, Consent, and Control):** Enforce strict Full Disk Access and Privacy permissions to prevent malware from accessing sensitive user data.
- **MDM/RMM Policies:** Use Mobile Device Management to restrict background task permissions and monitor for unauthorized LaunchAgents.
## Related Tools/Techniques
- **RustBucket:** A sophisticated macOS malware family.
- **Pirrit / Adload:** Prolific macOS adware and search hijackers.
- **LaunchDaemons / LaunchAgents:** Traditional macOS persistence mechanisms now tracked by BTM.
- **Objective-See Tools:** Open-source tools (like LuLu or KnockKnock) designed to monitor these mechanisms.