Komplex

MITRE ATT&CK: S0162 View on attack.mitre.org

Aliases: JHUHUGIT, JKEYSKW, SedUploader, Komplex

Malware type
backdoor
Family
Malware family
Operating systems
macos
Last IoC activity
2026-07-19 04:30:27
Profile updated
2026-07-07 15:44:56

Targeted industries: government-and-public-sector defense-and-aerospace

Targeted regions: country_code:us country_code:ru

Context

Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX.

Detection coverage

  • 2 YARA rules
  • 88 Sigma rules

Malware & tools used

  • File Deletion (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Process Discovery (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Web Protocols (attack-pattern)
  • Launch Agent (attack-pattern)
  • Hidden Files and Directories (attack-pattern)

Used by threat actors

Detection rules

  • CAPE_Seduploader (yara-rule)
  • MALPEDIA_Win_Seduploader_Auto (yara-rule)

Related threat objects

Reports & references

  • contagiodump.blogspot.de — Russian Apt Apt28 Collection Of Samples (report)
  • objective-see.com — Blog 0X16 (report)
  • malpedia.caad.fkie.fraunhofer.de — Osx.Komplex (report)
  • researchcenter.paloaltonetworks.com — Unit42 Sofacys Komplex Os X Trojan (report)
  • blog.malwarebytes.com — Komplex Mac Backdoor Answers Old Questions (report)
  • ESET — Eset Sednit Part1 (report)
  • researchcenter.paloaltonetworks.com — Unit42 Xagentosx Sofacys Xagent Macos Tool (report)
  • MITRE ATT&CK — S0162 (report)
  • researchcenter.paloaltonetworks.com — Unit42 Sofacys Komplex Os X Trojan (report)

External references