ITSEC Newsletter 2025-12-25

What makes this sample notable is its defense evasion. The downloader programmatically strips the com.apple.quarantine extended attribute before executing downloaded payloads, bypassing Gatekeeper. Rate limiting logic prevents rapid re-execution, likely to frustrate sandbox analysis. Code signature validation ensures only payloads signed with a specific TeamIdentifier execute. These are not commodity malware techniques.

Today I present a new DCOM object that can be used for command execution and potential persistence. This technique abuses older initial-access and persistence methods involving Control Panel items. We’ll start with Control Panel items, how adversaries have used them for initial access and persistence, and how they can be leveraged via a DCOM object to execute commands. Finally, we’ll cover detection strategies to identify and respond to this activity.