WAVESHAPER
- Malware type
- backdoor
- Last IoC activity
- 2026-07-21 08:33:45
- Profile updated
- 2026-07-07 14:37:47
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
According to Mandiant, WAVESHAPER is a backdoor written in C++ and packed by an unknown packer that targets macOS. The backdoor supports downloading and executing arbitrary payloads retrieved from its command-and-control (C2 or C&C) server, which is provided via the command-line parameters. To communicate with the adversary infrastructure, WAVESHAPER leverages the curl library for either HTTP or HTTPS, depending on the command-line argument provided. WAVESHAPER also runs as a daemon by forking itself into a child process that runs in the background detached from the parent session and collects system information, which is sent to the C&C server in a HTTP POST request.
Reports & references
- cloud.google.com — Unc1069 Targets Cryptocurrency Ai Social Engineering (report)
- malpedia.caad.fkie.fraunhofer.de — Osx.Waveshaper (report)
- cloud.google.com — North Korea Threat Actor Targets Axios Npm Package (report)