Threat intelligence / Malware

OSX_OCEANLOTUS.D

[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) is a macOS backdoor used by [APT32](https://attack.mitre.org/groups/G0050). First discovered in 2015, [APT32](https://attack.mitre.org/groups/G0050) has continued to make improvements using a plugin architecture to extend capabilities, specifically using `.dylib` files. [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can also determine it's permission level and execute according to access type (`root` or `user`).(Citation: Unit42 OceanLotus 2017)(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) is a macOS backdoor used by [APT32](https://attack.mitre.org/groups/G0050). First discovered in 2015, [APT32](https://attack.mitre.org/groups/G0050) has continued to make improvements using a plugin architecture to extend capabilities, specifically using `.dylib` files. [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can also determine it's permission level and execute according to access type (`root` or `user`).(Citation: Unit42 OceanLotus 2017)(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)

Labels

malware

29 recorded

Relationships

uses

from APT32

Group

uses

to Archive via Custom Method

Technique

uses

to Archive via Library

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Gatekeeper Bypass

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Launch Agent

Technique

uses

to Launch Daemon

Technique

uses

to Linux and Mac Permissions

Technique

uses

to Masquerade File Type

Technique

uses

to Masquerade Task or Service

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Non-Standard Port

Technique

uses

Technique

uses

to Shared Modules

Technique

uses

to Software Packing

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

Technique

uses

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

6 external

References

mitre-attack

S0352

Backdoor.MacOS.OCEANLOTUS.F

—

OSX_OCEANLOTUS.D

—

Unit42 OceanLotus 2017

https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/

TrendMicro MacOS April 2018

https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/

Trend Micro MacOS Backdoor November 2020

https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html