Stealthy Attributes of Lazarus APT Group: Evading Detection with Extended Attributes

Group-IB researchers describe a macOS trojan family (RustyAttr) used by or linked to APT Lazarus that smuggles and executes shell scripts stored in custom extended file attributes via Tauri-built applications; the report details execution flow, decoys, interface commands, MITRE mappings, IOCs (domains, IPs, SHA256 hashes), and mitigations, noting limited samples, no confirmed victims, and that macOS Gatekeeper and a revoked signing certificate currently limit impact.